I have a browser game I made that runs in MVC3 .Net. Because everyone needs to be on a level playing field, to stop people using macros to click their mouse at a million miles per hour I simply added:
if ($.active < 10) { //stuff }
to my javascript. Nifty enough and works fine, but since it’s client side it’s hard to trust. I’m trying to replicate this server side though and I’m having some trouble trying to come up with an equivalent. Is there anywhere else anyone can think of that would be better to move this type of setting to? A setting in IIS, a web.config setting? I’ve looked around the internet and can’t really find anything that would be similar.
Thoughts?
The usual server-side solution to this is called “rate limiting”. You identify relevant requests at the server from a particular client, you keep track of how fast these requests arrive and you pick some maximum number of requests per second or requests per minute that you’re going to allow. If that number is exceeded, you decide what strategy to deploy. You can delay them, return an error, disconnect them, logout the user, etc… Sometimes, it’s advantageous to pick a strategy that keeps the client from knowing that it’s being rate limited so it can’t knowingly detect and adapt, still trying to maximize it’s throughput.
You can get as detailed as you want, even picking different rate limiting strategies for different actions in the API if needed.
You try to pick a number for the rate limiting that a legitimate real user would never hit, but obviously one that keeps machines from abusing either your servers or the game logic.