mtg-online-drafter/docs/development/devlog/2025-12-16-215000_anti_tampering.md

Anti-Tampering Implementation

Objective

Implement a robust anti-tampering system to prevent players (including the host) from manipulating the game state via malicious client-side emissions.

Changes

1. Server (src/server/managers/RoomManager.ts):

   • Added getPlayerBySocket(socketId) to securely identify the player associated with a connection, eliminating reliance on client-provided IDs.

2. Server (src/server/index.ts):

   • Refactored all major socket event listeners (pick_card, game_action, start_draft, player_ready) to use roomManager.getPlayerBySocket(socket.id).
   • The server now ignores playerId and roomId sent in the payload (where applicable) and uses the trusted session context instead.
   • This ensures that a user can only perform actions for themselves in the room they are actually connected to.

3. Server (src/server/managers/GameManager.ts):

   • Updated handleAction to accept an authentic actorId.
   • Added ownership/controller checks to sensitive actions:
     • moveCard: Only the controller can move a card.
     • updateLife: Only the player can update their own life.
     • drawCard, createToken, etc.: Validated against actorId.

4. Frontend (GameView.tsx, DraftView.tsx, DeckBuilderView.tsx):

   • Cleaned up socket emissions to stop sending redundant roomId and playerId fields, aligning client behavior with the new secure server expectations (though server would safely ignore them anyway).

Result

The system is now significantly more resistant to session hijacking or spoofing. Users cannot act as other players or manipulate game state objects they do not control, even if they manually emit socket events from the console.