将游戏分数从客户端更新到服务器数据库的最安全方法？ JavaScript
所以我有这个完全在客户端运行的游戏。除了下载玩游戏的初始脚本之外，没有任何服务器交互。无论如何，在游戏结束时，我希望客户端发回应该在服务器数据库中更新的分数。现在我已经开始接受这样一个事实：我根本无法向黑客隐藏这一点并发送原样的分数。但我想知道我可以修改整个过程到什么级别，黑客操纵正在发送的数据实际上变得相当不可行。当然，我不希望分数以纯文本形式从客户端计算机发送，并且我不希望我的服务器执行复杂的解密算法。因此，要实现相当大的安全性，让每个汤姆迪克和哈利都不会破解分数，最好的方法是什么......我希望有人可以提供一个很好的小方法，我可以努力......:)谢谢
，所以我的理想结果应该是->拥有由不可信方（玩家）进行的计算（分数）的可信结果！
-编辑-
有人告诉我一些关于在图片获取请求中隐藏数据的事情。就像，我正在画布（html5）上实现这个游戏。所以他要求我在游戏结束时从我的服务器获取游戏结束图像，并且他们请求应包含哈希分数。我不太明白完整的过程，但如果你能解释一下，我会很高兴！ :)
coda^ 这样你就可以很好地屏蔽请求
shouvik我该怎么做！？
coda^ 您可以编写要提交的校验和。比如 12312312a12313a232 是你的 md5，其中包含分数。将资产引入画布，例如
coda^ server.com/images/md5_hash_of_score/congratulations.png
coda^ 您可以通过 htaccess 重写服务器端
So I have this game that is completely run on the client. No server interaction what so ever apart from downloading the initial scripts to play the game. Anyway at the end of the game I would like for the client to send me back the scores which should be updated in the server database. Now I have come to accept the fact that there is no way on earth I can hide this from a hacker and send the scores unaltered. But I would like to know till what level can I modify the whole process that it virtually becomes pretty infeasible for the hacker manipulate the data which is being sent. For sure I would not like the score to be sent as plain text from client machine and I don't want my server to perform complex decryption algorithm. What is the best way hence to achieve considerable amount of security that every tom dick and harry doesn't hack the scores... I hope someone could provide a nice little way that I could work on... :) Thanks
So my ideal result should be -> have trusted result from a calculation (of score) made by an untrusted party (the player)!
-Edit-
Someone told me something about hiding the data in a picture get request. Like, I am implementing this game on canvas (html5). So he asked me at the end of the game to fetch a game over image from my server, and they request should contain the hashed score. I did not exactly understand the complete process but if you could explain it, would be really glad! :)
coda^ so you can mask the requests nicely
shouvik how do I do it!?
coda^ you can compose the checksum you want to submit. like 12312312a12313a232 is your md5 which contains the score. bring in an asset into the canvas like
coda^ server.com/images/md5_hash_of_score/congratulations.png
coda^ which you can rewrite server side via htaccess
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
你似乎已经知道这一点，但只是强调一下； 你无法阻止某人这样做；你只能让它变得尽可能困难！
假设你当前提交的分数为：
在 Firebug 中观看的人可以轻松区分分数提交的位置，并更改它。
submit_score.php泄露了它，参数名称也是如此。分数是一个容易区分的整数。/interaction.php?score=5/interaction.php?a=5用户越来越难以弄清楚什么正在发生。
现在你可以让分数变得更难改变（再次强调，更难，不是不可能）。首先，您可以对其进行加密（显然您稍后需要能够解密它）。
你说出它的名字，你就做到了。现在您已经有了
interaction.php?a=e。接下来你可以做的就是用其他东西对分数进行哈希处理。发送带有分数的哈希值，并在服务器上重新计算。例如，
md5()带有随机字符串的分数，并在请求中发送分数（编码）、字符串和哈希：当请求到达服务器时，执行以下操作：
显然人们可以（相对）轻松地浏览 JavaScript 代码并查看发生了什么；所以让他们的处境变得更加困难。缩小并混淆代码。
如果你让某人变得足够困难，他们会尝试理解你的 JavaScript，尝试使用 Firebug，不明白发生了什么，也不会打扰；为了在你的游戏中获得一些额外的积分。
You seem to know this already, but just to stress; you cannot stop someone doing this; you can only make it as hard as possible!
Assume you currently submit the score as:
Someone watching in Firebug can easily distinguish where the score is submitted, and to alter it.
submit_score.phpgives it away, as does the name of the parameter. The score is a easily distinguishable integer./interaction.php?score=5/interaction.php?a=5It's getting harder for the user to work out what is going on.
Now you can make the score harder (again, harder, not impossible), to change. First, you can encrypt it (obviously you'll need to be able to decrpt it later).
You name it, you do it. So you now have
interaction.php?a=e.The next thing you can do is hash the score with something else. Send the hash with the score, and recalculate it on the server. For example,
md5()the score with a random string, and send the score (encoded), the string, and the hash in the request:When the request hits the server, do:
Obviously people can (relatively) easily go through your JavaScript code and see what's going on; so make it harder for them there. Minify and Obfuscate the code.
If you make it hard enough for someone, they're going to try understand your JavaScript, try using Firebug, not understand what's going on, and not bother; for the sake of getting a few extra points on your game.
使用 OAuth 之类的东西来授权从客户端到服务器的请求。
标头包含与请求正文匹配的令牌。如果这两者不匹配，则丢弃该请求。不需要在服务器端解密，而是对body进行加密，然后检查服务器端得到的结果与token是否匹配，以判断body是否被修改
Use something like OAuth to authorize the request from client to server.
The header contains a token which matches to the body of the request. if these two doesn't match, then discard the request. Don't need to decrypt at server side, instead encrypt the body and check if the result obtained at server side and the token matches the same to find if the body was modified
<罢工>
哦，是的，有！
您可以使用 RSA 或任何其他公钥加密方法（也称为非对称加密）。
为服务器创建一组（公钥和私钥）密钥。
让您的客户端代码包含服务器的公钥。
在游戏结束时，客户端代码对分数进行加密（使用此密钥）并将两者（纯分数和加密分数）发送到服务器。
服务器解密并检查明文分数和解密分数是否相同。
如果是，则接受分数。
如果不是，则拒绝（中间有黑客或网络错误）。
-------更新------------更正----------------
正如Ambrosia指出的那样，我的方法完全失败了一种攻击。
您真正想要的是从不可信方（玩家）进行的计算（分数）中获得可信结果。实现这一目标并不容易。
请参阅：http://coltrane.wiwi.hu -berlin.de/~fis/texts/2003-profit-untrust.pdf
还有这个：http://www.cse.psu.edu/~snarayan/publications/securecomputation.pdf
而这个（需要订阅 ACM 数字图书馆）：http://portal.acm.org/itation.cfm?id=643477.643479
Oh yes, there is!
You can use RSA or any other public key encryption method (also called assymetric cryptography).
Create a set of (public and private) keys for the server.
Have your client code include your server's public key.
At the end of the game, the client code, encrypts the score (with this key) and sends both (plain score and encrypted score) to server.
Server decrypts and checks if plain score and decrypted one are same.
If yes, accept score.
If not, reject (there's a hacker or network error in the middle).
-------UPDATE-----------CORRECTION--------------
As Ambrosia, pointed out, my approach fails completely with this kind of attack.
What you actually want is to have a trusted result from a calculation (of score) made by an untrusted party (the player). No easy way to achieve this.
See this: http://coltrane.wiwi.hu-berlin.de/~fis/texts/2003-profit-untrust.pdf
Also this one: http://www.cse.psu.edu/~snarayan/publications/securecomputation.pdf
And this (which needs a subscription to the ACM digital library): http://portal.acm.org/citation.cfm?id=643477.643479
您可以使用 ajax 将分数（和任何标识符）发送到服务器吗？除非他们打开萤火虫之类的东西，否则他们不会看到它发生。
Can you use ajax to send the score (and any identifiers) to the server? Unless they have something like firebug open they won't see it happening.
让客户端向您发送凭据（或某种会话信息，以防您没有登录凭据）并通过 SSL (https) 执行此操作。这样您就可以同时进行身份验证和完整性控制。对于服务器和客户端来说非常简单且极其轻量。
Make the client send you the credentials (or some sort of session information in case you don't have logon credentials) and do that over SSL (https). This way you have both authentication and integrity control. Very easy and extremely lightweight for both server and client.