Prevent client from controlling data to server
up vote
3
down vote
favorite
I've been making a simple socket.io program where the players can move around in an environment, with the client sending the server events.
However, it seems that the client can use the console to falsify data and send it to the server (by using socket.emit()).
Is there a way to combat that, so that the server only accepts "real" data, or to prevent the client from sending false data?
javascript node.js socket.io
asked Nov 11 at 3:03
Sarah
83
add a comment |
up vote
3
down vote
favorite
I've been making a simple socket.io program where the players can move around in an environment, with the client sending the server events.
However, it seems that the client can use the console to falsify data and send it to the server (by using socket.emit()).
Is there a way to combat that, so that the server only accepts "real" data, or to prevent the client from sending false data?
javascript node.js socket.io
asked Nov 11 at 3:03
Sarah
83
4
Only if you have some way of verifying the data. You can never trust the client.
– SLaks
Nov 11 at 3:06
If a user sends a message from the console that they could also send from the page, that would seem okay - but if there is something that would make it invalid, you could check conditions on the server? Hard to be sure without knowing more.
– jacob.mccrumb
Nov 11 at 4:16
add a comment |
up vote
3
down vote
favorite
up vote
3
down vote
favorite
I've been making a simple socket.io program where the players can move around in an environment, with the client sending the server events.
However, it seems that the client can use the console to falsify data and send it to the server (by using socket.emit()).
Is there a way to combat that, so that the server only accepts "real" data, or to prevent the client from sending false data?
javascript node.js socket.io
asked Nov 11 at 3:03
Sarah
83
I've been making a simple socket.io program where the players can move around in an environment, with the client sending the server events.
However, it seems that the client can use the console to falsify data and send it to the server (by using socket.emit()).
Is there a way to combat that, so that the server only accepts "real" data, or to prevent the client from sending false data?
javascript node.js socket.io
javascript node.js socket.io
asked Nov 11 at 3:03
Sarah
83
asked Nov 11 at 3:03
Sarah
83
asked Nov 11 at 3:03
Sarah
83
asked Nov 11 at 3:03
Sarah
83
asked Nov 11 at 3:03
Sarah
83
83
4
Only if you have some way of verifying the data. You can never trust the client.
– SLaks
Nov 11 at 3:06
If a user sends a message from the console that they could also send from the page, that would seem okay - but if there is something that would make it invalid, you could check conditions on the server? Hard to be sure without knowing more.
– jacob.mccrumb
Nov 11 at 4:16
add a comment |
4
Only if you have some way of verifying the data. You can never trust the client.
– SLaks
Nov 11 at 3:06
If a user sends a message from the console that they could also send from the page, that would seem okay - but if there is something that would make it invalid, you could check conditions on the server? Hard to be sure without knowing more.
– jacob.mccrumb
Nov 11 at 4:16
4
4
Only if you have some way of verifying the data. You can never trust the client.
– SLaks
Nov 11 at 3:06
Only if you have some way of verifying the data. You can never trust the client.
– SLaks
Nov 11 at 3:06
If a user sends a message from the console that they could also send from the page, that would seem okay - but if there is something that would make it invalid, you could check conditions on the server? Hard to be sure without knowing more.
– jacob.mccrumb
Nov 11 at 4:16
If a user sends a message from the console that they could also send from the page, that would seem okay - but if there is something that would make it invalid, you could check conditions on the server? Hard to be sure without knowing more.
– jacob.mccrumb
Nov 11 at 4:16
add a comment |
1 Answer
1
active
oldest
votes
up vote
1
down vote
accepted
Your server should always hold the state of the application, and have a list of all possible actions for each state.
For example, if your character can move on a map, the server should always keep the coordinate of the player. Let's say the player is at coordinate (x, y). The server will only allow messages that move the player to (x+1, y+1), (x-1, y+1), (x+1, y-1) or (x-1, y-1). Any other message should be discarded.
If it receives a message saying the player wants to move to (x+500, y+500), it should ignore it and potentially mark the player as a cheater and disconnect it.
answered Nov 11 at 20:22
mihai
22.9k73968
add a comment |
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
up vote
1
down vote
accepted
Your server should always hold the state of the application, and have a list of all possible actions for each state.
For example, if your character can move on a map, the server should always keep the coordinate of the player. Let's say the player is at coordinate (x, y). The server will only allow messages that move the player to (x+1, y+1), (x-1, y+1), (x+1, y-1) or (x-1, y-1). Any other message should be discarded.
If it receives a message saying the player wants to move to (x+500, y+500), it should ignore it and potentially mark the player as a cheater and disconnect it.
answered Nov 11 at 20:22
mihai
22.9k73968
add a comment |
up vote
1
down vote
accepted
Your server should always hold the state of the application, and have a list of all possible actions for each state.
For example, if your character can move on a map, the server should always keep the coordinate of the player. Let's say the player is at coordinate (x, y). The server will only allow messages that move the player to (x+1, y+1), (x-1, y+1), (x+1, y-1) or (x-1, y-1). Any other message should be discarded.
If it receives a message saying the player wants to move to (x+500, y+500), it should ignore it and potentially mark the player as a cheater and disconnect it.
answered Nov 11 at 20:22
mihai
22.9k73968
add a comment |
up vote
1
down vote
accepted
up vote
1
down vote
accepted
Your server should always hold the state of the application, and have a list of all possible actions for each state.
For example, if your character can move on a map, the server should always keep the coordinate of the player. Let's say the player is at coordinate (x, y). The server will only allow messages that move the player to (x+1, y+1), (x-1, y+1), (x+1, y-1) or (x-1, y-1). Any other message should be discarded.
If it receives a message saying the player wants to move to (x+500, y+500), it should ignore it and potentially mark the player as a cheater and disconnect it.
answered Nov 11 at 20:22
mihai
22.9k73968
Your server should always hold the state of the application, and have a list of all possible actions for each state.
For example, if your character can move on a map, the server should always keep the coordinate of the player. Let's say the player is at coordinate (x, y). The server will only allow messages that move the player to (x+1, y+1), (x-1, y+1), (x+1, y-1) or (x-1, y-1). Any other message should be discarded.
If it receives a message saying the player wants to move to (x+500, y+500), it should ignore it and potentially mark the player as a cheater and disconnect it.
answered Nov 11 at 20:22
mihai
22.9k73968
edited Nov 11 at 20:35
answered Nov 11 at 20:22
mihai
22.9k73968
answered Nov 11 at 20:22
mihai
22.9k73968
answered Nov 11 at 20:22
mihai
22.9k73968
22.9k73968
add a comment |
add a comment |
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53245491%2fprevent-client-from-controlling-data-to-server%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
4
Only if you have some way of verifying the data. You can never trust the client.
– SLaks
Nov 11 at 3:06
If a user sends a message from the console that they could also send from the page, that would seem okay - but if there is something that would make it invalid, you could check conditions on the server? Hard to be sure without knowing more.
– jacob.mccrumb
Nov 11 at 4:16