Public/Private AppID

Reznok

In the current design of Photon, it appears that the AppID is supposed to remain secret. It's what's used to authenticate to the Photon Cloud system and allows for creating sessions. If the AppID were compromised, a malicious user could:
1. Use that AppID for their own project, and pass the costs off to the real owner
2. Create a ton of rooms/sessions and flood it (essentially a DoS)
3. Probably more...

It make sense that there's an auth token for this, but what I can't fathom is why every client is required to use the same token as the servers. I propose that there should be a Public token, which is used by clients in the exact same way, but is unable to do certain things on the server (such as creating new sessions), and a Private token, which is used by servers, that allows the high levels of access required to actually create sessions.

I've seen a few threads on this topic that suggest obfuscating/making the AppID hard to find, but that's still a client side protection which is just bad.

ramonmelo

Hello,

If you are concerned about someone else using your App ID, you can easily setup the Custom Authentication system that will let only "valid" users connect. Any AppID has this available and it's independent of the game build, as it occurs before the client even touching your game server (https://doc.photonengine.com/en-us/bolt/current/connection-and-authentication/custom-authentication).

But thanks for your feedback, we always appreciate constructive comments.

--
Ramon Melo
Photon Bolt Team