How can we ensure that users data (Entities, Global Entities, Leaderboards, Statistics etc) are *only* writable from cloud-scripts?
-
Hi team,
While working I thought of a potential vulnerability unless I'm misunderstanding something.
I'm working on a game in which no sensitive inputs could come from the client. As in, never trust the client.
Basically, my app will take non-sensitive inputs, calculate results in cloud scripts, and finally securely update relevant items from cloud-scripts.But, as I was watching the bootcamp, I realized, what's stopping a bad-actor from doing the following:
- Identify the app runs on braincloud. This part isn't difficult, even email verification links will lead to a braincloud page.
- Once knowing the app is running on braincloud, watch the bootcamp series to learn of the various APIs.
- Authenticate from their machine.
- Start making POST requests to various operations (IE update global entity, update custom entity, update statistic) with their authenticated session.
How can I prevent this? Basically want to lock out all of these api's from outside of cloud-scripts-- its the only way I can see to maintain competitive integrity unless I've missed something.
@Paul-Winterhalder or anyone else, any ideas?
-
Use API blocking in the cloud code category to block all apis from client that write your user entities. Then clients can only write their entities using cloud-code and there you have the total control
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login