Prevent client from controlling data to server

Question

I've been making a simple socket.io program where the players can move around in an environment, with the client sending the server events.

However, it seems that the client can use the console to falsify data and send it to the server (by using socket.emit()).

Is there a way to combat that, so that the server only accepts "real" data, or to prevent the client from sending false data?

Answer 1

Your server should always hold the state of the application, and have a list of all possible actions for each state.

For example, if your character can move on a map, the server should always keep the coordinate of the player. Let's say the player is at coordinate (x, y). The server will only allow messages that move the player to (x+1, y+1), (x-1, y+1), (x+1, y-1) or (x-1, y-1). Any other message should be discarded.

If it receives a message saying the player wants to move to (x+500, y+500), it should ignore it and potentially mark the player as a cheater and disconnect it.