Using WWWForm to post from your game, preventing hacking

Unity Engine
,
1

Hello everyone,

So I have probably a strange, maybe a stupid question here. Let’s say you’re using the WWWForm class to send information from your game to a url, which stores information in a sql database. So you create your form object and create fields to post with the values you need to send, etc.

How much of a security risk is it, or rather a hacking risk, for someone to figure out what url you’re using, what variables you’re using, and then create their own form and post things to the url themselves to cheat or screw up the database? For example, if someone reverse engineers the code somehow, figures out the url you post to, figures out the names of the values you use, and writes a script to post things to the database 1,000 times a second just to be evil.

Forgive me if I’m totally off base here and worrying about this too much, this approach I’m going at for my next game is new to me, and I’m trying to think of all the ways in which things could go wrong.

Is this something I should worry about? Is there something any of you do to ensure the values you receive only come from your game, and if they come from anywhere else you ignore them?

Thanks for any feedback on this, I appreciate it.

David

2

It is very easy to figure it out, and very easy to hack.

You need some key that is both being sent, and hidden on the server, that can be used to authenticate that the request came from the game.

3

Ok, so my fears are not unfounded. I’ll do some research for the best way to create some sort of authentication for this.

Thanks very much for your reply Tempest :slight_smile:

David