Forum ‹ BigDB ‹ How is QuickConnect and BigDB related?

[Maras]

Im probably just stupid but i don't get it.

If i connect via QuickConnect, how can i know on server side that I'm already authorized? Which table should i use? PlayerObject is empty.

Do I have to send username and password and then check it again on server side?

Best option for me now is to make QuickConnect auth, then send username + password + login/register value, then create/load BigDB object and use that. But that doesn't feel right....

[Henrik]

Ever user has a connectuserid, you can retrieve this both client-side and server-side:

http://playerio.com/documentation/refer ... nectUserId
http://playerio.com/documentation/refer ... nectUserId

When you use the built-in PlayerObject, this is simply a DatabaseObject in the table PlayerObjects, with the connectuserid as a key. We recommend that you use the built-in methods to access the PlayerObject though, since it's a lot easier:

http://playerio.com/documentation/refer ... ayerObject
http://playerio.com/documentation/refer ... ayerObject

Note that you won't see anything in the admin panel for the PlayerObjects table until you've accessed a PlayerObject of a player, added data to it and called Save() on it.

[Maras]

Well but then you can simply hack it by changing username in PlayerIO.connect, or not?

[Henrik]

Only if you allow regular connect without auth, but if you use QuickConnect there's no reason to do that.

[Maras]

Oh thanks, that's it.

[Maras]

Hmmm... But still, anyone who knows PlayerIO can hack it by using PlayerIO.Connect and sending fake username, right?

If i recieve for eg. username simpleMaras as ConnectUserId, how can i know if it's really user Maras and not hacker, who just typed "simpleMaras" to PlayerIO.Connect?

[Henrik]

You can know it's not a hacker by disallowing regular Connect in the first place. Simply check "Require authentication" on the edit connections page for your public connection, and enter random junk in the shared secret field, and then noone can connect, since they can't calculate the required auth.

[Maras]

Ah, thanks again.