如何以一种不可篡改的方式确定http请求的顺序？

Question

I am designing an online game. Within the game, a player makes a series of moves. Previous moves can effect moves can effect later moves. This means the order of moves is crucial. The moves are implemented as AJAX requests. My backend is expressjs with node.

I could implement moves asynchronously but there is a slight chance that earlier moves might finish after later moves. I could make sure that the move tasks are completed in the order the requests were received by chaining requests onto promises but can I guarantee that an http request made before another will arrive before another?

I could timestamp the moves client side and process them in that order. My concern is that users might cheat by simulating timestamped requests, ruining the order, crashing the game if they are about to lose. This is because some moves will break the game if they are executed in the wrong order.

Of course I can handle this error but I can't figure out the true order of moves by checking their contents because sometimes multiple orders would be legal yet players might have more information as the make certain moves so it is crucial that the true order is executed. Even though the game wouldn't actually crash it would be impossible to determine the true order. Even if I include the entire gamestate in each request it is still potentially spoofable.

Is there some way I can determine the order of http requests in a way that users can't tamper with? I can't see another solution to this problem.

Answer 1

It's really not clear what problem you're trying to solve. It is very simple to code a client to make a bunch of http requests and to then process them in the order they were sent (regardless of the order the responses were received). A simple combination of any promise-driven ajax call (such as jQuery) and Promise.all() will do that for you if you are sending multiple requests at the same time.

If you are not sending them at the same time, such that you might send a request, a little later send another request (but before previous response is back), then send some more requests, etc..., then you can just create a queue for responses. Each Ajax call is tied to a queue entry. When the response comes back the response goes into the queue entry. Each time you get a response, you process the oldest items in the queue that you have responses for and you process them in the order of the queue. This allows you to do random send time requests, but always process responses in order.

Since all of this ordering is done client-side, it is not tamperproof (nothing done client-side is tamperproof), but it would require actual modification of the Javascript or the queue data structure, not just modifying a response in order to change the order of processing. To makes things more tamperproof, you have to move more decision making to the server where it can't be tampered with.

Here's a simple promise-based ajax queue that lets you send as many requests as you want and guarantees that the responses will be processed in order.

var queueAjax = (function() {
    var lastAjax = Promise.resolve();

    return function (url, options) {
        // chain to the prior promise so this won't get resolved until all prior items
        // in the queue have been fulfilled in some way
        var priorPromise = lastAjax.catch(function() {
            // always fulfilled
            return;
        });
        var ajaxPromise = doAjax(url, options).then(function(val) {
            return {val: val};
        }, function(err) {
            return {err: err};
        });
        lastAjax = Promise.all([ajaxPromise, priorPromise]).then(function(results) {
            var result = results[0];
            // if there was an error, then throw to reject with that err
            if (result.hasOwnProperty("err")) {
                throw err;
            } else {
                return result.val;
            }
        });
        return lastAjax;
    }
})();

// sample usage
queueAjax(someUrl, someOptions).then(function(val) {
    // process results
});

queueAjax(someUrl2, someOptions2).then(function(val) {
    // process results
});

queueAjax(someUrl3, someOptions3).then(function(val) {
    // process results
});

This queuing system function sends the ajax requests in parallel, but makes sure their .then() handlers are called in the order the requests were sent. Unlike Promise.all() , you can add new requests to the queue at any time and they will just be added to the sequence.

Here's a working demo: https://jsfiddle.net/jfriend00/7r2j1qme/