0

I am working on an application where a user has to complete a puzzle and check within a given time limit.

This is an HTML5 based game, I can't keep the solution on the client side. but I also want to avoid the latency that will be caused when we check for the correctness of the player's attempt.

Is there a way I can check the correctness of the solution on the client side safely ?

One implementation I was considering was to take the hash of the solution and compare it with hash of user's solution at the client side and once he finally submits it, recheck it on the server side.

Any potential flaws here or are their cleaner ways to accomplish the same ?

Improve this question
4
  • 1
    If you're concerned about security, i.e. preventing cheating, delivering a hash is no help at all. If the user can compromise the client to submit solutions they didn't earn, they can steal the delivered hash and pretend they computed it. See programmers.stackexchange.com/questions/251707.
    – Kilian Foth
    Aug 6, 2014 at 15:53
  • 1
    This is a bit vague, but as a general principle any obfuscation that you apply on the client side can be overcome by any decent programmer, because they have access to your code.
    – Robert Harvey
    Aug 6, 2014 at 15:54
  • 4
    If you are worrying about transport latency, forget about it. You will have sub-second accuracy for almost all users.
    – kevin cline
    Aug 6, 2014 at 15:59
  • 1
    @KilianFoth If I understand the poster correctly, he's only using the hash to determine whether to check the full solution server side. Still, I agree with kevin cline that latencies people will see don't make this necessary.
    – Gort the Robot
    Aug 6, 2014 at 17:13

2 Answers 2

Reset to default
1

If you decide to go with a client-side solution you must be prepared for the fact that someone will crack the hash or whatever else you decide to do. If this puzzle victory/loss isn't being recorded into a greater scoreboard that is retained across games then you might as well do that since it'll have no impact on you if they cheat.

If you are going to record these onto a leaderboard or something similar than integrity of score is paramount. You'll want to postback the page to the server and check it there. I wouldn't even attempt this with ajax since the user could capture what data you are sending back and, based on what variables you are sending, alter them to be a winner.

You could also do a clientside check, and only if they win post the page back and double check that they actually did win. If they lose then no need to postback since there is nothing to double check.

Improve this answer
1

Depending on the puzzle you could use a rule based solution check. So for a sudoku puzzle you wouldn't explicitly list the value of each square just check that each column, row, and 3 by 3 section each have exactly one instance each number one through nine.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.