Hi guys,
Hope you all are doing great.
I know that probably this is not the first time you receive a comment/question like this but unfortunately I was not able to find an answer surfing the web.
As you know, when you send a Ajax Post to a file the data being sent is easily traceable if you use a browser third party plugin; in order to check the functioning in some web applications I use Firebug which is the one that works better for me since it helps me a lot to identify problems in jquery plugins, php inserts and similar, so in php I?m able to add security features to my code in order to avoid code injection etc (I?m not even close to be a genius programmer but know the basics in several programming languages, pretty basic stuff), so after uploading one of my games for testing purposes I noticed that my inserts to the database were really insecure.
The thing is that every time my html5 game made with C2 sends a post to my php file so I can make an insert to the DB, the post is easily read in Firebug so if I copy the post url (let?s say mysite.com and execute the post again directly from my browser the post is performed again. I know I can work with sessions to increase security, require login data to know my users, set cookies etc but at the end the post will work. My concern is let?s say I make a game for a company that will give any kind of prize or incentive to the users with higher scores suddenly a mid experienced programmer will be able to review the destiny of my post and simply manipulate the post from the browser and pass whatever information on a simply url (http://www.mysite.com?score=5000 or mysite.com its just a matter of analyzing with Firebug the content of the post and then modify the string or variables being transmitted by ajax.
I really do not want to seem dramatic, its just that Construct 2 is too good to be true and I really hope that any of you can give me some tips to increase the security of the Ajax post sent from games made with this wonderful software. Is there any way to avoid the full post url from being readable during the Ajax transmission? Any of you guys know any extra security that can be added or probably another way to send scores to a database without using the Ajax object? I know many options that could make the trick but believe me I have been running in circles, I tried to convert the c2runtime.js file to c2runtime.php and then put some hashes inside the code in order to encode it (yes later on you need to use php headers to add the js functionality to the file again), did not work. I also tried using md5 encryption to generate a key randomly and then compare it when the post reaches my php file but did not work either, at the end if you pass the md5 encoded data as it is through the browser the php file will recognize it as good due to obvious reasons, so this is not an option (lesson learned the hard way).
I will really appreciate your advice guys, this is a software used even by Microsoft so I know that any of you will have a proper answer, as I told you I?m not a code guru nor a smart**s, I?m just really excited with all the possibilities you get with C2, I also know tha Ajax is not the most secure option and that?s not C2?s fault, it?s just the way it is, but I know this place has brilliant minds and the best thing is that they are not selfish at all at the moment of sharing the knowledge.
Thanks again.