WebRPC - how to send secure?

Rusildo

The document says:
This can be done by setting the appropriate webflag (SendSecure = 0x02) when calling the WebRPC operation method from client code. https://doc.photonengine.com/en/realtime/current/reference/webrpc
How can I set this webflag?

JohnTube

Hi @Rusildo,

Currently WebFlags are not implemented client side, it will be available in the next update.
However you can easily tweak OpWebRPC code to add this feature:
you just need to send a byte parameter with key = ParameterCode.EventForward 234 and value = SendAuthCookie 0x02. Here is how:

PhotonNetwork.cs
before

public static bool WebRpc(string name, object parameters)
    {
        return networkingPeer.WebRpc(name, parameters);
    }

after

public static bool WebRpc(string name, object parameters, bool sendAuthCookie = false)
    {
        return networkingPeer.WebRpc(name, parameters, sendAuthCookie);
    }

NetworkingPeer.cs
before

public bool WebRpc(string uriPath, object parameters)
    {
        Dictionary<byte, object> opParameters = new Dictionary<byte, object>();
        opParameters.Add(ParameterCode.UriPath, uriPath);
        opParameters.Add(ParameterCode.WebRpcParameters, parameters);
        return this.OpCustom(OperationCode.WebRpc, opParameters, true);
    }

after

public bool WebRpc(string uriPath, object parameters, bool sendAuthCookie)
    {
        Dictionary<byte, object> opParameters = new Dictionary<byte, object>();
        opParameters.Add(ParameterCode.UriPath, uriPath);
        opParameters.Add(ParameterCode.WebRpcParameters, parameters);
        if (sendAuthCookie)
        {
            opParameters.Add(ParameterCode.EventForward, (byte)0x02);
        }
        return this.OpCustom(OperationCode.WebRpc, opParameters, true);
    }

juniordiscart

Hi @JohnTube

My apologies for reviving an old thread, but I have a question related to this as well.
It seems that we still have to manually add your suggested code, as it is still not available in the newer versions of PUN? Not that this is much of a problem, just wondering whether this was a bit forgotten...

However, I have a question about sending data securely over a WebRPC call. What does the AuthCookie do? I assume that it forwards the AuthCookie assigned for that player at the server along with the WebRPC call when the PUN server receives the WebRPC call?

But does this prevent a malicious player from sending a similar packet with adjusted values? Or are the WebRPC packets encrypted?
For example: there's a tournament running in the game where a player sends his score to our webserver after finishing a matchup. Is the data protected from the player in the sense that he can monitor his packet stream, copy the packet, altering his score and sending the request again?
If the packets are not secured, do you have any suggestions for securing the data in them?

Kind regards and thanks!

JohnTube

Hi @juniordiscart,

AuthCookie is what you return from web service to Photon server in the custom authentication response.
It will not be available from client.
Yes the AuthCookie is encrypted.
When you set AuthCookie web flag in WebRPC or some other operations that can forward webhooks, the AuthCookie of the respective player will be sent from Photon Server back to your web service to verify the identity of the player and make sure the origin of the request is Photon Server.