#129385: "It is possible to see other players' destinations by inspecting the websocket connection"

• Falls du eine Fehlermeldung auf dem Bildschirm siehst, bitte kopieren und einfügen.
Each player's destinations should only be made known to them.
• Bitte erkläre, was du machen wolltest, was du dann getan hast und was dann passiert ist
It is visible on game replay, and also visible when playing a new game.

How to reproduce:
1. Start/Join a new game.
2. Open the Chrome devtools to the Network tab.
3. Refresh the game webpage.
4. Find the websocket connection that contains moves (websocket connections are easily identified by status code 101 (protocol upgrade); there should be two websockets and the one that contains moves is the second one).
5. Click on it to look at the incoming websocket packets.
6. Keep some destinations using the game UI.
7. Observe that a websocket packet will be received containing some JSON, which contains `\"type\":\"destinationsPicked\"`. This same packet also contains the pairs of cities that form each destination you picked. They look like `\"from\":6,\"to\":31`, where "6" and "31" will be replaced by the actual destinations you picked. These numbers are the cities on the map. While it isn't possible to match numbers to cities right now, it is possible once you have played enough games.
8. Go back to step 1, and repeat until you have figured out which destination each number refers to.
9. Go back to step 1, but now observe that for step 7, you actually receive a packet anytime any player chooses their cards, and the packet contains the player's username as well as the destinations that they have to connect.

Now I have not built a game on BGA before, but a quick read of boardgamearena.com/doc/Tutorial_hearts suggests that it is possible to notify just one player (to tell them their private information). If that is implementable, it should be implemented to prevent cheating.
• Welchen Browser benutzt du?
Google Chrome v126

• Bitte kopiere den Text, der in Englisch anstatt in deiner Sprache angezeigt wird, und füge ihn hier ein. Falls du einen Screenshot dieses Fehlers hast (optimale Vorgehensweise), kannst du ihn bei Imgur.com hochladen, den Link kopieren und hier einfügen.
Each player's destinations should only be made known to them.
• Ist dieser Text auf der Übersetzungsseite verfügbar? Wenn ja, wurde dieser vor mehr als 24 Stunden übersetzt?
It is visible on game replay, and also visible when playing a new game.

How to reproduce:
1. Start/Join a new game.
2. Open the Chrome devtools to the Network tab.
3. Refresh the game webpage.
4. Find the websocket connection that contains moves (websocket connections are easily identified by status code 101 (protocol upgrade); there should be two websockets and the one that contains moves is the second one).
5. Click on it to look at the incoming websocket packets.
6. Keep some destinations using the game UI.
7. Observe that a websocket packet will be received containing some JSON, which contains `\"type\":\"destinationsPicked\"`. This same packet also contains the pairs of cities that form each destination you picked. They look like `\"from\":6,\"to\":31`, where "6" and "31" will be replaced by the actual destinations you picked. These numbers are the cities on the map. While it isn't possible to match numbers to cities right now, it is possible once you have played enough games.
8. Go back to step 1, and repeat until you have figured out which destination each number refers to.
9. Go back to step 1, but now observe that for step 7, you actually receive a packet anytime any player chooses their cards, and the packet contains the player's username as well as the destinations that they have to connect.

Now I have not built a game on BGA before, but a quick read of boardgamearena.com/doc/Tutorial_hearts suggests that it is possible to notify just one player (to tell them their private information). If that is implementable, it should be implemented to prevent cheating.
• Welchen Browser benutzt du?
Google Chrome v126

• Bitte erkläre deinen Vorschlag so präzise und genau wie möglich, damit er leicht zu verstehen ist.
Each player's destinations should only be made known to them.
• Welchen Browser benutzt du?
Google Chrome v126

• Was wurde auf dem Bildschirm angezeigt, als du blockiert wurdest (weißer Bildschirm? Teil der Spieloberfläche? Fehlermeldung?)
Each player's destinations should only be made known to them.
• Welchen Browser benutzt du?
Google Chrome v126

• Welcher Teil der Spielregel wurde durch die BGA-Adaption nicht beachtet?
Each player's destinations should only be made known to them.
• Ist der Regelverstoß in der Spielwiederholung zu sehen? Falls ja, bei welcher Zugnummer?
It is visible on game replay, and also visible when playing a new game.

How to reproduce:
1. Start/Join a new game.
2. Open the Chrome devtools to the Network tab.
3. Refresh the game webpage.
4. Find the websocket connection that contains moves (websocket connections are easily identified by status code 101 (protocol upgrade); there should be two websockets and the one that contains moves is the second one).
5. Click on it to look at the incoming websocket packets.
6. Keep some destinations using the game UI.
7. Observe that a websocket packet will be received containing some JSON, which contains `\"type\":\"destinationsPicked\"`. This same packet also contains the pairs of cities that form each destination you picked. They look like `\"from\":6,\"to\":31`, where "6" and "31" will be replaced by the actual destinations you picked. These numbers are the cities on the map. While it isn't possible to match numbers to cities right now, it is possible once you have played enough games.
8. Go back to step 1, and repeat until you have figured out which destination each number refers to.
9. Go back to step 1, but now observe that for step 7, you actually receive a packet anytime any player chooses their cards, and the packet contains the player's username as well as the destinations that they have to connect.

Now I have not built a game on BGA before, but a quick read of boardgamearena.com/doc/Tutorial_hearts suggests that it is possible to notify just one player (to tell them their private information). If that is implementable, it should be implemented to prevent cheating.
• Welchen Browser benutzt du?
Google Chrome v126

• Welche Spielaktion wolltest du durchführen?
Each player's destinations should only be made known to them.
• Was versuchst du, um diese Spielaktion auszulösen?
It is visible on game replay, and also visible when playing a new game.

How to reproduce:
1. Start/Join a new game.
2. Open the Chrome devtools to the Network tab.
3. Refresh the game webpage.
4. Find the websocket connection that contains moves (websocket connections are easily identified by status code 101 (protocol upgrade); there should be two websockets and the one that contains moves is the second one).
5. Click on it to look at the incoming websocket packets.
6. Keep some destinations using the game UI.
7. Observe that a websocket packet will be received containing some JSON, which contains `\"type\":\"destinationsPicked\"`. This same packet also contains the pairs of cities that form each destination you picked. They look like `\"from\":6,\"to\":31`, where "6" and "31" will be replaced by the actual destinations you picked. These numbers are the cities on the map. While it isn't possible to match numbers to cities right now, it is possible once you have played enough games.
8. Go back to step 1, and repeat until you have figured out which destination each number refers to.
9. Go back to step 1, but now observe that for step 7, you actually receive a packet anytime any player chooses their cards, and the packet contains the player's username as well as the destinations that they have to connect.

Now I have not built a game on BGA before, but a quick read of boardgamearena.com/doc/Tutorial_hearts suggests that it is possible to notify just one player (to tell them their private information). If that is implementable, it should be implemented to prevent cheating.
• Was passiert, wenn du dies versuchst (Fehlermeldung, Statusmeldung des Spiels, ...)?
• Welchen Browser benutzt du?
Google Chrome v126

• An welcher Stelle im Spiel ist das Problem aufgetreten? Was war die aktuelle Spielanweisung?
Each player's destinations should only be made known to them.
• Was passiert, wenn du die Spielaktion ausführen möchtest (Fehlermeldung, Statusmeldung des Spiels, ...)?
It is visible on game replay, and also visible when playing a new game.

How to reproduce:
1. Start/Join a new game.
2. Open the Chrome devtools to the Network tab.
3. Refresh the game webpage.
4. Find the websocket connection that contains moves (websocket connections are easily identified by status code 101 (protocol upgrade); there should be two websockets and the one that contains moves is the second one).
5. Click on it to look at the incoming websocket packets.
6. Keep some destinations using the game UI.
7. Observe that a websocket packet will be received containing some JSON, which contains `\"type\":\"destinationsPicked\"`. This same packet also contains the pairs of cities that form each destination you picked. They look like `\"from\":6,\"to\":31`, where "6" and "31" will be replaced by the actual destinations you picked. These numbers are the cities on the map. While it isn't possible to match numbers to cities right now, it is possible once you have played enough games.
8. Go back to step 1, and repeat until you have figured out which destination each number refers to.
9. Go back to step 1, but now observe that for step 7, you actually receive a packet anytime any player chooses their cards, and the packet contains the player's username as well as the destinations that they have to connect.

Now I have not built a game on BGA before, but a quick read of boardgamearena.com/doc/Tutorial_hearts suggests that it is possible to notify just one player (to tell them their private information). If that is implementable, it should be implemented to prevent cheating.
• Welchen Browser benutzt du?
Google Chrome v126

• Bitte beschreibe die Anzeigeschwierigkeiten. Falls du einen Screenshot dieses Fehlers hast (optimale Vorgehensweise), kannst du ihn bei Imgur.com hochladen, den Link kopieren und hier einfügen.
Each player's destinations should only be made known to them.
• Welchen Browser benutzt du?
Google Chrome v126

• Bitte kopiere den Text, der in Englisch anstatt in deiner Sprache angezeigt wird, und füge ihn hier ein. Falls du einen Screenshot dieses Fehlers hast (optimale Vorgehensweise), kannst du ihn bei Imgur.com hochladen, den Link kopieren und hier einfügen.
Each player's destinations should only be made known to them.
• Ist dieser Text auf der Übersetzungsseite verfügbar? Wenn ja, wurde dieser vor mehr als 24 Stunden übersetzt?
It is visible on game replay, and also visible when playing a new game.

How to reproduce:
1. Start/Join a new game.
2. Open the Chrome devtools to the Network tab.
3. Refresh the game webpage.
4. Find the websocket connection that contains moves (websocket connections are easily identified by status code 101 (protocol upgrade); there should be two websockets and the one that contains moves is the second one).
5. Click on it to look at the incoming websocket packets.
6. Keep some destinations using the game UI.
7. Observe that a websocket packet will be received containing some JSON, which contains `\"type\":\"destinationsPicked\"`. This same packet also contains the pairs of cities that form each destination you picked. They look like `\"from\":6,\"to\":31`, where "6" and "31" will be replaced by the actual destinations you picked. These numbers are the cities on the map. While it isn't possible to match numbers to cities right now, it is possible once you have played enough games.
8. Go back to step 1, and repeat until you have figured out which destination each number refers to.
9. Go back to step 1, but now observe that for step 7, you actually receive a packet anytime any player chooses their cards, and the packet contains the player's username as well as the destinations that they have to connect.

Now I have not built a game on BGA before, but a quick read of boardgamearena.com/doc/Tutorial_hearts suggests that it is possible to notify just one player (to tell them their private information). If that is implementable, it should be implemented to prevent cheating.
• Welchen Browser benutzt du?
Google Chrome v126

• Bitte erkläre deinen Vorschlag so präzise und genau wie möglich, damit er leicht zu verstehen ist.
Each player's destinations should only be made known to them.
• Welchen Browser benutzt du?
Google Chrome v126

Worum geht es bei dieser Meldung?

Was ist passiert? Bitte wähle unten aus

Was ist passiert? Bitte wähle unten aus

Bitte überprüfe, ob bereits eine Meldung zum gleichen Thema existiert

Detaillierte Beschreibung

Meldungshistorie

Ergänze diese Meldung

Ändere den Status der Meldung auf:

Hilfe

Leiste einen Beitrag

Folge uns