Currently all logics run in the browser side.
To qualify as a real captcha, it should verify the result in the server side. Here is my consideration:
- Client record the user's key stroke sequences (↑ ↓← →,space) and each key stroke's relative timestamp.
- Client send the saved stroke sequence to server.
- Server start a doom instance (with node.js or headless browser), apply the sequence as input to check whether the game clear condition is actually met in the end.
To prevent replay attack, the game level should be randomized with a seed provided by the server.
I am not familiar with WASM or doom. Is it possible to implement?
Currently all logics run in the browser side.
To qualify as a real captcha, it should verify the result in the server side. Here is my consideration:
To prevent replay attack, the game level should be randomized with a seed provided by the server.
I am not familiar with WASM or doom. Is it possible to implement?