How browser game leaderboards get cheated — and what we do about it
A browser game runs on the player's own computer, and the player can change anything on it. That makes a high-score table a fairly soft target.
The simplest leaderboard works like this: the run ends, the page sends your name and score to the server, and the server writes it down. It's also the quickest way to end up with a board full of 99,999,999s.
How people cheat
The easiest way needs no programming at all. The browser's developer tools show every request a page makes. Copy the one that says "here's my score", change the number, send it again.
A bit more effort: change the game while it's running. Everything the game knows lives in the page, so a player can set their own score, make themselves invincible or delete the enemies, then let the game submit as normal. Any check that runs in the browser can be switched off by whoever is using the browser.
And even if a score can't be edited, someone can record one real, good submission and just send it again, over and over.
The rule we stick to
The server never takes the game's word for anything a player would want to lie about. The game reports what happened ("I mined this tile", "I guessed this colour"). The server decides what that's worth.
In Huedle your browser never sends a score, because it doesn't know one. It sends your guesses. The server knows the colour, sends back the clues and works out the score. The only thing you can "fake" is picking good colours, and that's the game.
In Strata the server owns the prices. When you sell ore, it looks up what it's worth. When you buy an upgrade, it checks you can afford it. A modified game can show whatever balance it likes on screen, but it can't create money.
Every run also starts with a signed ticket from the server, and every later request has to carry it. That ties each request to one run the server actually started, so a recorded request can't simply be replayed. In Strata the server can even rebuild the world and look at the tile you say you mined (more on that here).
What we deliberately don't do
We don't scramble the game code. It slows a determined person down a little and makes our own bugs much harder to find. If the protection only works while nobody reads the code, it doesn't work.
We don't automatically throw out scores for looking too good. Rules like that end up catching the best real players first, and we'd rather let an odd score stand.
And we can't stop someone who writes a program that genuinely plays the game. That's a lot of work to top a free browser game, and we're fine with it being the only way left.
One we got wrong
Those tickets are signed with a key only the server knows. We once changed Strata's key during a routine update, and everyone with the game open turned into a brand-new miner with no money and no upgrades, because their ticket stopped being valid. That key now doesn't get touched casually.