For a game that I’m making I am using the game to use a WWWForm to post to a PHP script on my website which adds the player’s stats to a leader board (MySQL database). It works like a charm, but it’s not secure because right now anyone with the URL to the script can send a post request and add to the leaderboard.
It seems that things like http referer don’t work to validate post requests sent from unity to my PHP script, so I am just wondering what methods of validation can I use in the PHP script to make sure that post requests are coming from my game and not some outside source? Is this even possible?
You could setup a validation code that is send with your form to the server.
Easiest way: Send a static secure code(text) with your form for validation( plus points for SSL so nobody can read the content of the secure code.
As always it’s not 100% secure because if a hacker really likes to anger you, he can try to reverse engineer your code and steal the secure code(text).
Are you suggesting just another field to be sent in the post that contains a key?
That sound like a option to me. With that key you can validate that the request did come from your game.
if its fixed “security code”, then user can still use that with direct url also.
Could at least add some hash string, that the server knows how to check from the submitted value.
Like if you post value “10”, your hash code is created from that 10 value, and server will check
if hash code matches with the “10”…
Can still also filter out any requests with extra header fields, wrong user agents etc. so that it wouldnt work directly from browser without extra tools.
Probably more robust way would be to keep sending stats every now and then (during the game),
so that the server can check if the player has actually received or earned those stats… within realistic period of time. (cannot suddenly post lvl100, if havent posted lvl99 value during the game etc.)
Sure the user can if he can guess the a correct 500+ character long string that you could use for your secure code.
As long you are using SSL nobody that did not reverse engineer your game and readout the code can post fake values
You are free to hash your value and validate it via the hash, but that’s not gone stop anyone for long.
Checking if the value the user sends are even possible is a good idea.
Good suggestions. I like that idea of validating bit by bit to check if updates are realistic.
Also, I’ll have to look up how to make a SSL post request via Unity.