question

Since you allow the client to pass in the amount of currency as parameter, there is no way to fully guarantee the security of incoming values. For data security, all important data processing logic should be done by the server based on your game logic. For example, in the common scenario to ensure that the reward currency after the player kills the Boss will not be hacked, before playing the Boss level, the client first informs the server that the player is about to hit the Boss, then all the data of the player’s operations are processed by the server, include the final killing. After the fight, the server will issue the currency according to the configuration file written into the server in advance by the game. During this entire process, the client only provides the request to start the game and the player’s in-game battle operation request, and the client cannot touch the reward distribution process at all, which ensure the security of the data.