Prevent Cheating On Javascript Game

I'm currently developing a game using JavaScript/JQuery. It's a simple brick breaker type of game keeping score, levels etc. I'm planning on implementing a leader board that users

Solution 1:

Make the page submit a complete replay of the game rather than just the final score. Given the random seed and a frame by frame record of user inputs, your server should be able to simulate and reconstruct the game and verify the score.

Obviously the replay can be faked too, but it would amount to so much work (actually playing the game and actually getting a good score, albeit with the unfair advantage of AI assistance, slowing down and other client hacks) that tool-assisted scores should deserve to be in the leaderboard.

Solution 2:

obfuscate their score by creating an equation that can only be calcuated on the server side.

Edit: RobG is correct in that it will need to be calculated on the client side.

I hacked the Angry Birds game when it launched on chrome:

http://wesbos.com/all-levels-html5-angry-birds/

However, they have since obfuscate the code so much that its impossible to figure out which function calculated hash..

Solution 3:

You can't guarantee no cheating, it's impossible. The server responds to requests, that's it. It has no idea what code is running on the client, what type of user agent or environment it's in or even whether it's running your code or a facsimile.

You can take various steps to make spoofing more difficult, but you can't make it impossible. The cost of such measures (usually seen as "security") is usually balanced with the value of the asset being protected.

Solution 4:

An idea I had was to use a game-timer. If the user changes the score to an amount that is obviously not possible given the amount of time that has passed, refuse to log the information. You could start the timer and check the timer in your server-side script.

Now of course if they change the score only by a few points this checking may fail, but, if they only add a less than impacting amount then maybe it won't matter to you as much?

Solution 5:

Never put anything on the client. The client is in the hands of the enemy. Never ever ever forget this.

-- The Laws of Online World Design