{"id":1056,"date":"2018-10-31T15:53:08","date_gmt":"2018-10-31T15:53:08","guid":{"rendered":"http:\/\/smartfoxserver.com\/blog\/?p=1056"},"modified":"2018-10-31T15:54:12","modified_gmt":"2018-10-31T15:54:12","slug":"security-for-html5-games","status":"publish","type":"post","link":"https:\/\/smartfoxserver.com\/blog\/security-for-html5-games\/","title":{"rendered":"Security for HTML5 games"},"content":{"rendered":"

With SmartFoxServer 2X 2.13.4<\/a> we introduced websocket origin checks for HTML5 clients<\/strong>. What this mechanism does is essentially verify the\u00a0provenance of the client against a white-list of domains configured by the server admin. If the client origin does not match any of the allowed\u00a0domains\u00a0the client connection is denied.<\/p>\n

In this article we’ll\u00a0demonstrate how to use and configure websocket origins in SmartFoxServer 2X and\u00a0discuss the advantages and limitations of this security measure. We’ll also take a deeper look at the issue of cheating clients and propose several ideas to improve the security of your online game.<\/p>\n

\u00bb Who is knocking at the door?<\/h2>\n

Publishing\u00a0a multiplayer\u00a0HTML5 game online has many advantages, one of which is that the game client itself is always available for access to any player\u00a0armed with an Internet browser.<\/p>\n

This\u00a0direct availability however can also attract\u00a0folks who are not interested in the game itself but rather in messing with it, by dissecting the client\u00a0and trying\u00a0to understand how to take advantage of potential flaws or bugs.<\/p>\n

With\u00a0web-based games cheaters can have an easy time accessing the game client’s code and try to recreate a different client that attempts to abuse the system. Without a specific protection that is able to recognize\u00a0a genuine client from a fake one, it will be very hard to get rid of these attackers.<\/p>\n

\u00bb Websocket origin to the rescue<\/h2>\n

Fortunately for us the websocket protocol includes an “Origin” parameter in the HTTP request (specifically in the “upgrade” request) that can be leveraged to apply some basic security checks.<\/p>\n

In fact the “Origin”\u00a0value will tell us the source of the web page requesting a socket connection and with that we can verify it against a list of safe domains.<\/p>\n

Below is a screenshot from the SFS2X AdminTool, under the Server Settings<\/strong> > Web server tab<\/strong>\"\"<\/p>\n

Here in the “Allowed client origin” box we have configured two valid domains:<\/p>\n