I'm building a simple clicker game to be played online.
The game saves clicks to my database by executing an Ajax post call to a php script.
Now I'm trying to figure out how I could limit the post submits from my server only so people couldn't cheat by just sending their own scores straight to the database by posting.
I tried limiting posts to my server IP or localhost but that doesn't work as Ajax post uses the users own IP and not the servers IP to post. So I wasn't able to post even from my own server anymore after that.
I'm saving the clicks to localstorage which I know is another place where people could cheat.
What could I do to only allow the posts from my server?
One cheat-proof solution would be to make the server increment the clicks while user/player only send an info about an action - like in a multiplayer game.
You would need a web-socket connection to the server and treat each connection/socket as an individual player.
One easy solution would be to use Node.js backend + socket.io library.