• Products
  • Solutions
  • Made with Unity
  • Learning
  • Support & Services
  • Community
  • Asset Store
  • Get Unity

UNITY ACCOUNT

You need a Unity Account to shop in the Online and Asset Stores, participate in the Unity Community and manage your license portfolio. Login Create account
  • Blog
  • Forums
  • Answers
  • Evangelists
  • User Groups
  • Beta Program
  • Advisory Panel

Navigation

  • Home
  • Products
  • Solutions
  • Made with Unity
  • Learning
  • Support & Services
  • Community
    • Blog
    • Forums
    • Answers
    • Evangelists
    • User Groups
    • Beta Program
    • Advisory Panel

Unity account

You need a Unity Account to shop in the Online and Asset Stores, participate in the Unity Community and manage your license portfolio. Login Create account

Language

  • Chinese
  • Spanish
  • Japanese
  • Korean
  • Portuguese
  • Ask a question
  • Spaces
    • Default
    • Help Room
    • META
    • Moderators
    • Topics
    • Questions
    • Users
    • Badges
  • Home /
avatar image
0
Question by Matheus-Crivellari · Mar 23, 2017 at 12:31 PM · webglsendmessagesecurity

Protecting WebGL Unity application from SendMessage exploitation

Sorry if I'm being redundant here but I couldn't find any question about this. Is there any other more secure way to call methods on my Unity WebGL appplication from browser's Javascript than using SendMessage?

I'm currently developing a web-game using SocketIO (because of its ease to use) for online multiplaying, so everytime I receive a socket event I call SendMessage to perform actions inside the game.

But, because of SendMessage being a public "user defined" function, it's easily findable and viewable its definition. This way we can easily override it with console.logs or even put a break point in its definition to track the values it receives directly from the browser's element inspector.

The thing is, anybody with a minimum knowledge in Unity WebGL development (or even web development) can hack the game by exploiting SendMessage, making the game unsecure and unfair to the rest of players.

Is there any alternative to SendMessage, or at least any way to make it more secure?

Thanks in advance.

Comment
Add comment
10 |3000 characters needed characters left characters exceeded
▼
  • Viewable by all users
  • Viewable by moderators
  • Viewable by moderators and the original poster
  • Advanced visibility
Viewable by all users

0 Replies

· Add your reply
  • Sort: 

Your answer

Hint: You can notify a user about this post by typing @username

Up to 2 attachments (including images) can be used with a maximum of 524.3 kB each and 1.0 MB total.

Welcome to Unity Answers

The best place to ask and answer questions about development with Unity.

To help users navigate the site we have posted a site navigation guide.

If you are a new user to Unity Answers, check out our FAQ for more information.

Make sure to check out our Knowledge Base for commonly asked Unity questions.

If you are a moderator, see our Moderator Guidelines page.

We are making improvements to UA, see the list of changes.



Follow this Question

Answers Answers and Comments

4 People are following this question.

avatar image avatar image avatar image avatar image

Related Questions

how to use sendmessage to call a unity function from html 1 Answer

Connection slower with higher update rate using LLAPI. webgl 0 Answers

WebGL: protect content 0 Answers

why is my javascript to webgl communication so slow for a large string 1 Answer

How to send multiple values from browser to unity webgl game? 1 Answer

  • Anonymous
  • Sign in
  • Create
  • Ask a question
  • Spaces
  • Default
  • Help Room
  • META
  • Moderators
  • Explore
  • Topics
  • Questions
  • Users
  • Badges