Session Ticket reuse in fake client

Question

question

morphus@heartforgames.com asked Sep 14, '20

Session Ticket reuse in fake client

Thinking about the security/use of the session ticket/authentication process.

At the moment the only use of authentication, is to obtain a playerID that link between all possible authentication method.

So what i am wondering, is how can I prevent a fake client to impersonate "legit" client apps and make request to the game server.

A hacker/cheater don't even have to bother with the client, as long as he know his username/password, he can get a valid session ticket from PlayFab and if he can reverse engineer the client code (which is not that hard with Unity and similar engine) nothing prevent him to contact the server and make request.

I understand that the game server is authoritative, and won't accept any request like give me 100k virtual currency, since it's not a valid Client/Server command.

But nothing prevent it to automate all the possible action that the client/server communication currently allow.

If it's out of scope of Playfab, don't hesitate to tell me.

10 |1200

Attachments: Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

Answer 1 · 2020-09-14T06:22:44Z

Citrus Yan answered Sep 14, '20

PlayFab will always return a Session Ticket as long as a valid credential is provided, in this case, is the username & password, no matter where it came from, either a real player or a fake client. I think the core of the problem is to prevent credentials from being leaked in the first place, and, additionally, add some logics to identify abnormal calling patterns and take actions.

10 |1200

Attachments: Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

question

Session Ticket reuse in fake client

1 Answer

Write an Answer

Navigation

Spaces

question details