Game are really hard to develop, because you'll never be sure that no one will find the way to cheat. But there is some tips you can put in place to try to prevent cheat, in every type of game, whether it's written in Flash, JavaScript ...
The more important thing to think of is : You must never rely on client.
The server must
NEVER :
- rely on datas sent by the client (ids, coordinates, power, prices won.. ).
- save datas that it has not calculated and checked itself
ALWAYS
- has an up-to-date version of the client's properties. the server must always rely on that properties to allow/disallow any action, calculate new properties, store properties in databases, send to clients
- check the concordence between clients actions
- allow or disallow the client to do any action (you want to move left ? I check if you can... Yes you can, your x is now lastx-1 / No you can not, you're at the map limit, your x is now lastx )
- check if the elapsed time between two actions is possible. ( You asked me to jump. I replied you could, but that would take you 5 seconds before next action. You're asking me, two seconds after, to move right. It's not possible, you're jumping right now !).
The client must
- ALWAYS
- verify itself if it can perform an action before asking the server to do it =» less server calls, more security because there is two checks, by the client and by the server
- rely on server datas. (You sometimes can animate things - like counter - and calculate the animation client-side AND server side. BUT you can have latency client side that makes client datas a little different than server datas.)
Other cheat controls in case of step-by-step game
Server must
- validate every steps ( you try to do the second step, does your session says that you already performed the first one ? )
- has a validation datas for every steps ( You sent me that your score for this step was 1200, but the max score is 500, bug or cheat ? redo step please )
- keep traces of every step to validate/calculate datas at the end ( you send me this score at the first step, this one for the second, this one for the third... )
- check if the validation of a step is possible in the elapsed time ( you try to send me step 2 result. Step 2 takes at least 18 seconds to perform, you sent me step 1 result 4 secondes ago. Houston, we've got a problem )
- re-create a validation token for each calls ( ok, next time you call me, send me this token with your message, I want to be sure that we are at the same point )
- (re)-create the session when the client download the game ( when you send a flash/javascript game file, when the client download the file from your server, make it go through a script that initialize the session, by making the file not cachable by the browser. If a client try to go to step 1 and the session does not exists, either the session is expired, or he tried to modify the flash/javascript file )
Very simple example case :
You have a real-time game with 2 players on the same map
Map properties : 3x3 - Coords {x : 0, y : 0} = corner top left
Server » players : player1 : { x : 0, y : 0, life : 5 }, player2 : { x : 3, y : 3, life : 2 }
Player1 » Server : move right
Server » players : player1 : { x : 1, y : 0, life : 5 }, player2 : { x : 3, y : 3, life : 2 }
Player2 » Server : move left
Server » players : player1 : { x : 1, y : 0, life : 5 }, player2 : { x : 2, y : 3, life : 2 }
Player2 » Server : move left
Server » players : player1 : { x : 1, y : 0, life : 5 }, player2 : { x : 1, y : 3, life : 2 }
Player1 » Server : move up
Server » player1 : you can not move
Server » players : player1 : { x : 1, y : 0, life : 5 }, player2 : { x : 1, y : 3, life : 2 }
Player1 » Server : move down
Server » players : player1 : { x : 1, y : 1, life : 5 }, player2 : { x : 1, y : 3, life : 2 }
Player2 » Server : hit
Server » Player2 : no one to hit
Server » players : player1 : { x : 1, y : 1, life : 5 }, player2 : { x : 1, y : 3, life : 2 }
Player2 » Server : move up
Server » players : player1 : { x : 1, y : 1, life : 5 }, player2 : { x : 1, y : 2, life : 2 }
Player2 » Server : hit
Server » players : player1 : { x : 1, y : 1, life : 3 }, player2 : { x : 1, y : 2, life : 2 }
Player1 » Server : hit
Server » players : player1 : { x : 1, y : 1, life : 3 }, player2 : { x : 1, y : 2, life : 1 }
Player2 » Server : hit
Server » players : fatal, player1 : { x : 1, y : 1, life : 0 }, player2 : { x : 1, y : 2, life : 1 }, player2 win
I'm sure I forgot some tips, and I'll update if it comes back to me, but I think you'll be able to manage your game with these and maybe think by yourself at securities to add.
The more important thing to think of is : You must never rely on client.
