Should the check correctness of a time constrained puzzle game application be done on the server side?

Question

I am working on an application where a user has to complete a puzzle and check within a given time limit.

This is an HTML5 based game, I can't keep the solution on the client side. but I also want to avoid the latency that will be caused when we check for the correctness of the player's attempt.

Is there a way I can check the correctness of the solution on the client side safely ?

One implementation I was considering was to take the hash of the solution and compare it with hash of user's solution at the client side and once he finally submits it, recheck it on the server side.

Any potential flaws here or are their cleaner ways to accomplish the same ?

Answer 1

If you decide to go with a client-side solution you must be prepared for the fact that someone will crack the hash or whatever else you decide to do. If this puzzle victory/loss isn't being recorded into a greater scoreboard that is retained across games then you might as well do that since it'll have no impact on you if they cheat.

If you are going to record these onto a leaderboard or something similar than integrity of score is paramount. You'll want to postback the page to the server and check it there. I wouldn't even attempt this with ajax since the user could capture what data you are sending back and, based on what variables you are sending, alter them to be a winner.

You could also do a clientside check, and only if they win post the page back and double check that they actually did win. If they lose then no need to postback since there is nothing to double check.

Answer 2

Depending on the puzzle you could use a rule based solution check. So for a sudoku puzzle you wouldn't explicitly list the value of each square just check that each column, row, and 3 by 3 section each have exactly one instance each number one through nine.