JApplet 写入安全吗？
因此，我正在创建一个 JApplet 游戏，并将用户信息保存到 APPDATA 中的 .txt 文件中。有没有更安全的方法来保存他们的信息，不允许他们编辑信息进行作弊？
So I am creating a JApplet Game, and I am saving the users info to a .txt file in the APPDATA. Is there a safer way to save their info, that won't allow them to edit it to cheat?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
基本上，防止作弊的唯一方法是让您控制的服务器计算分数并以其他方式执行游戏规则。如果您正在编写点对点游戏，可能会有一些协议允许用户在不涉及您的情况下确定其他玩家是否作弊。 ACM sigecom 定期发布有关此类协议的研究报告。但是，由于小程序安全模型的限制，用户需要授予您的小程序特殊权限才能使其直接与其他用户通信。
说到这里，我建议不要“将用户信息保存到 .txt 文件”。
%APPDATA%仅适用于 Windows，因此打破了“一次写入，随处运行”的原则；并且默认的小程序沙箱不允许读取或写入本地文件，因此您必须对小程序进行签名并说服您的用户它足够特别，值得如此提升的权限。但是，您确实有一些用于小程序/服务器通信的选项：
java.net.URL的 REST 调用Applet 自定义协议无法直接读取和写入 Cookie，但 JavaScript 可以，并且 JavaScript 可以调用 Applet 上的方法。将信息从服务器传递到小程序（但不能返回）的最后一种方法是通过 PARAM 标记。您甚至可以传递由服务器私钥签名的初始游戏状态数据以及 PARAM 标签中编码的 base64；这将阻止任何人“编辑”它，尽管如果有关游戏状态的某些内容应该对玩家隐藏但在小程序代码中已知，我想不出任何方法可以完全防止作弊。
Basically, the only way to prevent cheating is to have a server under your control calculate the score and otherwise enforce game rules. If you were writing a peer-to-peer game, there might be some protocol to allow users to determine if another player was cheating without involving you. ACM sigecom regularly publishes research about such protocols. However, because of the restrictions of the applet security model, users would need to grant your applet special permission for it to talk directly to other users anyway.
Speaking of that, I would advise against "saving the user's info to a .txt file".
%APPDATA%is Windows-only, thus breaking "write once run anywhere"; and the default applet sandbox does not allow reading or writing local files, so you'd have to sign the applet and convince your users that it was special enough to merit such elevated privileges.However, you do have a few options for applet/server communication:
java.net.URLApplets can't read and write cookies directly, but JavaScript can, and JavaScript can call methods on applets. One last way to pass information from the server to the applet (but not back out) is through PARAM tags. You could even pass initial game-state data signed by the server's private key and base64 encoded in a PARAM tag; which would prevent anyone from "editing" it, although I can't think of any way to completely prevent cheating if something about the game-state is supposed to be hidden from the player but known within the applet code.