SSL + HTTPS + hackers!

Unity Engine
1

I have a Unity WebGL app that communicates with a remote server using plain old WWW that calls several different php scripts on server and sending it parameters using WWWForm and POST and getting stuff back.

In the browser i can easily select the debugging console and see all the php scripts and their parameters being called, this is something i dont want because then a hacker can do the same and see everything and then hack my server.

Instead of me manually writing code to encrypt and decrypt on both sides, can I just buy an SSL certificate and enable SSL on my website, then use https for all communication.

Would doing this encrypt everything for me automatically so that hackers can’t just open their browser console and see which php scripts are getting called and the data being sent and received to/from it?

If that cant work then how to prevent everyone seeing which php scripts im calling and the parameters getting send to it (like passwords and session info for example).

How can anyone secure their game and server from hacker?

Thanks

2

SSL and https will not effect the game code from being able to be intercepted. You should have server handle protected stuff such as spawning etc and implement the proper checks. I know it’s a pain but you should have done it since you started coding the project. See if you can adjust changes accordingly.

3

Thanks for the comment, but what is a “server handle”, and “spawning”?

4

He means that with online games it is usually best to handle most of the actual game logic/validation on the server and not the client. Basically never trust anything coming from the client.

5

How would you have the server handle the game logic and validation if the client has to download files to run the application?

1 Like
6

This is a very broad topic not to be done in reply. But basically you either run the whole simulation on the server and just sync states with the clients or you run the simulation on the client and do a lot of validation on the server side whether whatever the clients says is plausible.