Prevent client from controlling data to server
I've been making a simple socket.io program where the players can move around in an environment, with the client sending the server events.
However, it seems that the client can use the console to falsify data and send it to the server (by using socket.emit()).
Is there a way to combat that, so that the server only accepts "real" data, or to prevent the client from sending false data?
javascript node.js socket.io
asked Nov 11 at 3:03
Sarah
123
add a comment |
I've been making a simple socket.io program where the players can move around in an environment, with the client sending the server events.
However, it seems that the client can use the console to falsify data and send it to the server (by using socket.emit()).
Is there a way to combat that, so that the server only accepts "real" data, or to prevent the client from sending false data?
javascript node.js socket.io
asked Nov 11 at 3:03
Sarah
123
4
Only if you have some way of verifying the data. You can never trust the client.
– SLaks
Nov 11 at 3:06
If a user sends a message from the console that they could also send from the page, that would seem okay - but if there is something that would make it invalid, you could check conditions on the server? Hard to be sure without knowing more.
– jacob.mccrumb
Nov 11 at 4:16
add a comment |
I've been making a simple socket.io program where the players can move around in an environment, with the client sending the server events.
However, it seems that the client can use the console to falsify data and send it to the server (by using socket.emit()).
Is there a way to combat that, so that the server only accepts "real" data, or to prevent the client from sending false data?
javascript node.js socket.io
asked Nov 11 at 3:03
Sarah
123
I've been making a simple socket.io program where the players can move around in an environment, with the client sending the server events.
However, it seems that the client can use the console to falsify data and send it to the server (by using socket.emit()).
Is there a way to combat that, so that the server only accepts "real" data, or to prevent the client from sending false data?
javascript node.js socket.io
javascript node.js socket.io
asked Nov 11 at 3:03
Sarah
123
asked Nov 11 at 3:03
Sarah
123
asked Nov 11 at 3:03
Sarah
123
asked Nov 11 at 3:03
Sarah
123
asked Nov 11 at 3:03
Sarah
123
123
4
Only if you have some way of verifying the data. You can never trust the client.
– SLaks
Nov 11 at 3:06
If a user sends a message from the console that they could also send from the page, that would seem okay - but if there is something that would make it invalid, you could check conditions on the server? Hard to be sure without knowing more.
– jacob.mccrumb
Nov 11 at 4:16
add a comment |
4
Only if you have some way of verifying the data. You can never trust the client.
– SLaks
Nov 11 at 3:06
If a user sends a message from the console that they could also send from the page, that would seem okay - but if there is something that would make it invalid, you could check conditions on the server? Hard to be sure without knowing more.
– jacob.mccrumb
Nov 11 at 4:16
4
4
Only if you have some way of verifying the data. You can never trust the client.
– SLaks
Nov 11 at 3:06
Only if you have some way of verifying the data. You can never trust the client.
– SLaks
Nov 11 at 3:06
If a user sends a message from the console that they could also send from the page, that would seem okay - but if there is something that would make it invalid, you could check conditions on the server? Hard to be sure without knowing more.
– jacob.mccrumb
Nov 11 at 4:16
If a user sends a message from the console that they could also send from the page, that would seem okay - but if there is something that would make it invalid, you could check conditions on the server? Hard to be sure without knowing more.
– jacob.mccrumb
Nov 11 at 4:16
add a comment |
1 Answer
1
active
oldest
votes
Your server should always hold the state of the application, and have a list of all possible actions for each state.
For example, if your character can move on a map, the server should always keep the coordinate of the player. Let's say the player is at coordinate (x, y). The server will only allow messages that move the player to (x+1, y+1), (x-1, y+1), (x+1, y-1) or (x-1, y-1). Any other message should be discarded.
If it receives a message saying the player wants to move to (x+500, y+500), it should ignore it and potentially mark the player as a cheater and disconnect it.
answered Nov 11 at 20:22
mihai
23.3k73968
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53245491%2fprevent-client-from-controlling-data-to-server%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
Your server should always hold the state of the application, and have a list of all possible actions for each state.
For example, if your character can move on a map, the server should always keep the coordinate of the player. Let's say the player is at coordinate (x, y). The server will only allow messages that move the player to (x+1, y+1), (x-1, y+1), (x+1, y-1) or (x-1, y-1). Any other message should be discarded.
If it receives a message saying the player wants to move to (x+500, y+500), it should ignore it and potentially mark the player as a cheater and disconnect it.
answered Nov 11 at 20:22
mihai
23.3k73968
add a comment |
Your server should always hold the state of the application, and have a list of all possible actions for each state.
For example, if your character can move on a map, the server should always keep the coordinate of the player. Let's say the player is at coordinate (x, y). The server will only allow messages that move the player to (x+1, y+1), (x-1, y+1), (x+1, y-1) or (x-1, y-1). Any other message should be discarded.
If it receives a message saying the player wants to move to (x+500, y+500), it should ignore it and potentially mark the player as a cheater and disconnect it.
answered Nov 11 at 20:22
mihai
23.3k73968
add a comment |
Your server should always hold the state of the application, and have a list of all possible actions for each state.
For example, if your character can move on a map, the server should always keep the coordinate of the player. Let's say the player is at coordinate (x, y). The server will only allow messages that move the player to (x+1, y+1), (x-1, y+1), (x+1, y-1) or (x-1, y-1). Any other message should be discarded.
If it receives a message saying the player wants to move to (x+500, y+500), it should ignore it and potentially mark the player as a cheater and disconnect it.
answered Nov 11 at 20:22
mihai
23.3k73968
Your server should always hold the state of the application, and have a list of all possible actions for each state.
For example, if your character can move on a map, the server should always keep the coordinate of the player. Let's say the player is at coordinate (x, y). The server will only allow messages that move the player to (x+1, y+1), (x-1, y+1), (x+1, y-1) or (x-1, y-1). Any other message should be discarded.
If it receives a message saying the player wants to move to (x+500, y+500), it should ignore it and potentially mark the player as a cheater and disconnect it.
answered Nov 11 at 20:22
mihai
23.3k73968
edited Nov 11 at 20:35
answered Nov 11 at 20:22
mihai
23.3k73968
answered Nov 11 at 20:22
mihai
23.3k73968
answered Nov 11 at 20:22
mihai
23.3k73968
23.3k73968
add a comment |
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Some of your past answers have not been well-received, and you're in danger of being blocked from answering.
Please pay close attention to the following guidance:
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53245491%2fprevent-client-from-controlling-data-to-server%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
4
Only if you have some way of verifying the data. You can never trust the client.
– SLaks
Nov 11 at 3:06
If a user sends a message from the console that they could also send from the page, that would seem okay - but if there is something that would make it invalid, you could check conditions on the server? Hard to be sure without knowing more.
– jacob.mccrumb
Nov 11 at 4:16