Unable to executeInventoryOperations on inventory V2 from server

Question

question

raj-1 asked Aug 24, '23

Unable to executeInventoryOperations on inventory V2 from server

Hi, I am trying to grant player some items (Economy V2) once he is created (by using rules player_created). I am using playstram event to trigger a azure function for this. I am trying to add these items to players inventory by using server's entity token and developer access key but api is failing due to unauthorise entity token.

Because of this issue I started using entity token which is sent from playstream event and it is giving the same error.

Finally I had to add this API call on client side to get entity token from client which allowed me to add these items to inventory.

According to me this is very insecure and needs attention. I think executeInventoryOperation API should also be accessible by developer secret or server entity token. Otherwise Inventory which is very important part of any game cannot be controlled freely as it will always need clients intervention to work.

If this is already possible without clients intervention, please let me know how to do it.

Thanks in advance

In-Game Economy Player Inventory

10 |1200

Attachments: Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

Answer 1 · 2023-08-24T10:00:27Z

Neils Shi answered Aug 24, '23

The API ExecuteInventoryOperations can and should be called on the server side, and we do not recommend calling it on the client side as this poses a serious security risk. Could you provide us with detailed error message? And we recommend that you debug Azure Function locally before you deploy it, or you can share your code with us so that we can do some research.

2

10 |1200

Attachments: Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

raj-1 commented · Sep 11, 2023 at 01:56 AM

Hi Neils Shi,

Here is azure function PlayFabSettings.staticSettings.DeveloperSecretKey = Constants.DeveloperSecret; PlayFabSettings.staticSettings.TitleId = Constants.TitleId; string requestBody = await new StreamReader(req.Body).ReadToEndAsync(); PlayerPlayStreamFunctionExecutionContext context =JsonConvert.DeserializeObject

0 ·

Neils Shi raj-1 commented · Sep 11, 2023 at 09:59 AM

Can you provide the error message or your full Azure Function code so that we can do some research? In your case, you should use “var context=JsonConvert.DeserializeObject<PlayerPlayStreamFunctionExecutionContext>(await req.ReadAsStringAsync());” to get the context and obtain MasterPlayerAccountId. And since the API ExecuteInventoryOperations needs title player account id, so, you can use GetTitlePlayersFromMasterPlayerAccountIds API to retrieve the entity of the title player account from the master player account id. And we also recommend that you debug your Azure Function locally first.

0 ·

question