question

Ryan Belgrave avatar image
Ryan Belgrave asked

Prevent LoginWithCustomID Spam

I am starting to use PlayFab for my new web based game and I would like to allow anonymous logins. I read though

https://docs.microsoft.com/en-us/gaming/playfab/features/authentication/login/login-basics-best-practices and it was very helpful. However being that my game is played via the web browser I would have to use LoginWithCustomID.

My understanding is that the client calls LoginWithCustomID with a body that has a unique ID and create account true. Then I can save the cluster id in the browser's local data so it can be used again to login as the same user.

So my question is how do I prevent clients of just spamming LoginWithCustomID with random IDs and creating tons of accounts? My first guess is don't call LoginWithCustomID on the client, instead call it on a backend server but I would still have the same problem.

I can't seem to think of a good solution for this. Any ideas? Or is this something that I just have to deal with somehow?

10 |1200
Toggle Comment visibility. Current Visibility: Viewable by all users

Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

3 Answers

·
v-humcin avatar image
v-humcin answered

There is built in protection that will throttle clients who are making an unusually high number of API calls. PlayFab is built to scale seamlessly with an increased number of players so the rest of your playerbase should not be affected if a user did try to spam this API call.

10 |1200
Toggle Comment visibility. Current Visibility: Viewable by all users

Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

Seth Du avatar image
Seth Du answered

This is a tricky question. Anonymous login can cause abusive uses and it cannot be completely avoided, however one thing you can do is to increase the time cost for the users (I will offer an example).

We usually do not suggest using Custom ID because it is not safe enough and players should not be able to input custom ID on their own. Generating random custom ID is a solution while for mobiles devices, LoginWithIOSDeviceID and LoginWithAndroidDeviceID are recommended because the device ID is unique.

You have mentioned that it is a website game. When player starts the game for the first time, there should be data to download and cache locally. You can config that if player wants to sign out and is about to create an another anonymous account after he has logged in, the all cached data should be deleted and re-download(user login information is with cached data). This will take some time and reduce the frequency of creating new accounts. In addition, you should not expose deleting data option on the GUI, which means players have to manually delete. Some Japanese mobile games are using this method to prevent players creating starter accounts but generally speaking, it won’t work efficiently. People always get ways to generating starter accounts if they want.

Thus, if you want to avoid abusive uses to some extent, another method is not providing anonymous login. Register processes should be required and no matter using username/email or logging with 3rd party platform accounts (Facebook, Google, Apple…), they will all improve the situation.

10 |1200
Toggle Comment visibility. Current Visibility: Viewable by all users

Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

Wolfgang avatar image
Wolfgang answered

I have a related question to this one.

I would like to use PlayFab to track user engagement via events with the client API, but to avoid dealing with the more complicated parts of the General Data Protection Regulation GDPR in the EU I would like to keep the tracking unrelated to personal information of the user. Hence I would use authentication via CustomID with an unique and static device-id from the user's device + CreateAccount enabled.

But wouldn't that mean that anyone who found out my game's PlayFab Title-ID (via reverse engineering etc.) could then use any of the PlayFab SDKs to start spamming events to maliciously skew/invalidate analytics or try to hit the event rate-limit for the used pricing plan?

Thanks

,

I have a somewhat similar question.

I am most interested in using PlayFab to track the occurance of certain events on the client (analytics), ideally without relating the data directly to personal information of a user (because of the General Data Protection Regulation GDPR in the EU this is really important)

My understanding is that I can do this by posting events authenticated only via CustomId based on some unique device-id.

But now my question is, if a user were to find out (by reverse engineering the client program) the PlayFab Title-ID of my game, wouldn't that mean that they could just download any PlayFab SDK and start spaming / abusing the client API ?

For smaller player-bases this could be done to maliciously skew the data or the intent could be just to reach the event-rate limit.

Am I missing something? Can this be prevented while still maintaning the requirement for anonymous tracking/analytics ?

Thanks

3 comments
10 |1200
Toggle Comment visibility. Current Visibility: Viewable by all users

Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

Wolfgang avatar image Wolfgang commented ·

Sorry, for some reason I got a "Page not found" error when first trying to post my question, the second time after rewriting it by hand both posts got somehow put into one.

0 Likes 0 ·
Seth Du avatar image Seth Du ♦ commented ·

For most client API calls, the API limit is player-specific and a player's limit won't affect others. Actions a player can do are very limited, for example, updating statistics too frequently will cause throttling. In terms of Cloud Script, you will need to add verification part for each function before any server APIs are called, but this process depends on your game design, there are no specific solutions here.

You may also keep track of unusual data updates and ban players if necessary. In addition, if some client APIs are not required by your game/clients, you may disable it via editing API policy.

Meanwhile, if you worry about login/register spam, you may refer to this thread: https://community.playfab.com/questions/28283/prevent-loginwithcustomid-spam.html

0 Likes 0 ·
Wolfgang avatar image Wolfgang Seth Du ♦ commented ·

Thanks @SethDu for the clarification.

PS: the link you gave links back to this same topic ?! ;)

1 Like 1 ·

Write an Answer

Hint: Notify or tag a user in this post by typing @username.

Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.