general request security

[Rifts]

What is the best method to prevent unauthorized requests being sent to your server? For example I have an ios game which sends a users name and score to my php server. Whats preventing someone from just sniffing the traffic and seeing the simple request to: 

http://mywebsite.com/addscore.php?name=jimmy&score=100

now cant anyone just copy paste that url and change that values to anything "cheat" the game?

 

All I can think to do is send a key with the url and check the key is correct, but if someone is sniffing the url they can see they key and its pointless anyway? 

 

what am i missing?

Edited April 12, 2015 by Rifts

[requinix]

You can't prevent someone from listening to requests and faking their own. It's just not possible.

 

The best thing you can do is rely on them being unable to read the game's code. Which isn't true, but it's harder than simply sniffing traffic. For example, you can hash some private key with the name and score (known as request signing) and get something like

http://www.example.com/addscore.php?name=jimmy&score=100&signature=1234567890abcdef

addscore.php calculates and verifies the signature before recording the score.

[Rifts]

Thanks for the input, so whats the best way to create this signature in objective-c that I can then decode in php?

[Rifts]

I figured this out using md5 i think

Edited April 12, 2015 by Rifts

[Tom10]

you could use the rand() function to generate a new key each time the page loads

$key = rand();

md5($key);