I want to secure access to a POST request so that the user cannot forge it via software such as postman.

Let’s say a player plays a game and gets a score. At the end of the game, the score is sent to the server through an API via a POST request. I want to be sure that this POST request was sent by the application and not by the user otherwise he could quite modify his score by simply making a POST request.

Currently I use JWT Token to authenticate the user.

I can not really stored secret in the application knowing that it is easily possible to get the source code of an apk file.

My stack:

  • API PHP with Lumen
  • Flutter

In your opinion, what is the best solution to secure this exchange?

  • Without knowing more about the architecture of your application and your network, it is difficult to answer this question. Besides, since this is an HTTP request as long as a network route exists between client and server something like PostMan can mock requests to your server. Even if you introduce JWT tokens. Are you trying to block external traffic? Internal? – Greg Burghardt Dec 4 '19 at 14:00

In general, you can't. Have a search: search "cheat" on gamedev.stackexchange. This is not a language or runtime limitation. It is simply that the server is not in control of the client software, the user is.

Whatever happens on the client side software can either be imitated by another application, or the malicious users reverse engineer your app and make a modified version that submits whatever value they want.

The only real solution is to handle game state on the server.

No, I'm not saying that I can't figure out a way to safely submit the score. I'm saying that as long as submitting the score is possible, there is a way to cheat it. And this is not because of me not being able to figure out hot to prevent it.

If you want to make sure it is not possible to cheat, you should not submit scores. Instead, you should send what the user does in the game to the server, and have the server compute the score. And even then, that alone does not rule out bots.

However, you can still improve the security of the app... I mean, deter attackers from messing with it. These measures come to mind:

  • Session tokens for the users (another app could authenticate with the right credentials)
  • Single use tokens to submit score (could be intercepted)
  • A digital signature on the app, checked client side (check can be faked)
  • Code obfuscation (can be worked around)

As I said, they deter the attacker, make it somewhat harder for them. Yet, not impossible.

See also Sending a client-side high-score to a server securely at security.stackexchange (the comments in the question and answers there are also worth reading).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.