How to encrypt user activity information in the browser so it can't be spoofed?

Question

My users are performing some actions on my website like clicking buttons. I need to award prizes if a certain sequence of buttons has been clicked. For every action I store the action information.

When they are done the activity information is sent to the server. How can I ensure they didn't just send me that information manually, but actually performed all required actions on the page, eg didn't spoof it?

Answer 1

Since the browser needs to understand the code, any determined human can do it too.

However you can compress your code using for instance Google Closure compiler. That will discourage most cheaters.

But if you really do want to keep things secret, only the server can guarantee you that.

Answer 2

In addition to Mic's answer (+1, very correct) note that no matter how well you protect the JavaScript, someone can use a UI automation testing tool (eg Selenium ) to script the clicking of buttons without any need to defeat your JavaScript.

Clicks are sent to the browser in a programmable manner and the browser has no idea they didn't come directly from user interaction.