How does this API validate that the request is real? Otherwise players could just keep calling this?
How does this API validate that the request is real? Otherwise players could just keep calling this?
The call to RewardAdActivity only requires that the reward be valid for the player, not that it was the last one returned from GetAdPlacements, meaning that the player could just keep calling it to receive rewards:
Usually you can limit how often an Ad placement may be viewed for a reward, for instance, 1 per hour, so that RewardAdActivity can only be called once per hour:
3 People are following this question.
