#129385: "It is possible to see other players' destinations by inspecting the websocket connection"

• Kopioi/liitä virheilmoitus näytöltäsi, jos sait sellaisen.
Each player's destinations should only be made known to them.
• Selitä mitä halusit tehdä, mitä teit ja mitä tapahtui
It is visible on game replay, and also visible when playing a new game.

How to reproduce:
1. Start/Join a new game.
2. Open the Chrome devtools to the Network tab.
3. Refresh the game webpage.
4. Find the websocket connection that contains moves (websocket connections are easily identified by status code 101 (protocol upgrade); there should be two websockets and the one that contains moves is the second one).
5. Click on it to look at the incoming websocket packets.
6. Keep some destinations using the game UI.
7. Observe that a websocket packet will be received containing some JSON, which contains `\"type\":\"destinationsPicked\"`. This same packet also contains the pairs of cities that form each destination you picked. They look like `\"from\":6,\"to\":31`, where "6" and "31" will be replaced by the actual destinations you picked. These numbers are the cities on the map. While it isn't possible to match numbers to cities right now, it is possible once you have played enough games.
8. Go back to step 1, and repeat until you have figured out which destination each number refers to.
9. Go back to step 1, but now observe that for step 7, you actually receive a packet anytime any player chooses their cards, and the packet contains the player's username as well as the destinations that they have to connect.

Now I have not built a game on BGA before, but a quick read of boardgamearena.com/doc/Tutorial_hearts suggests that it is possible to notify just one player (to tell them their private information). If that is implementable, it should be implemented to prevent cheating.
• Mikä on selaimesi?
Google Chrome v126

• Ole hyvä ja kopioi teksti englanniksi oman kielesi sijasta. Jos sinulla on kuvankaappaus tästä bugista, voit käyttää Imgur.com:a sen lähettämiseksi. Kopioi ja liitä linkki tähän.
Each player's destinations should only be made known to them.
• Onko tämä teksti saatavilla käännösjärjestelmässä? Jos on, onko sen käännöksestä yli 24 tuntia?
It is visible on game replay, and also visible when playing a new game.

How to reproduce:
1. Start/Join a new game.
2. Open the Chrome devtools to the Network tab.
3. Refresh the game webpage.
4. Find the websocket connection that contains moves (websocket connections are easily identified by status code 101 (protocol upgrade); there should be two websockets and the one that contains moves is the second one).
5. Click on it to look at the incoming websocket packets.
6. Keep some destinations using the game UI.
7. Observe that a websocket packet will be received containing some JSON, which contains `\"type\":\"destinationsPicked\"`. This same packet also contains the pairs of cities that form each destination you picked. They look like `\"from\":6,\"to\":31`, where "6" and "31" will be replaced by the actual destinations you picked. These numbers are the cities on the map. While it isn't possible to match numbers to cities right now, it is possible once you have played enough games.
8. Go back to step 1, and repeat until you have figured out which destination each number refers to.
9. Go back to step 1, but now observe that for step 7, you actually receive a packet anytime any player chooses their cards, and the packet contains the player's username as well as the destinations that they have to connect.

Now I have not built a game on BGA before, but a quick read of boardgamearena.com/doc/Tutorial_hearts suggests that it is possible to notify just one player (to tell them their private information). If that is implementable, it should be implemented to prevent cheating.
• Mikä on selaimesi?
Google Chrome v126

• Selitä ehdotuksesti tarkasti ja ytimekkäästi, jotta se on ymmärrettävissä niin helposti kuin mahdollista.
Each player's destinations should only be made known to them.
• Mikä on selaimesi?
Google Chrome v126

• Mitä näytöllä näkyi kun olit estettynä (Tyhjä ruutu? Osa pelin käyttöliittymästä? Virheilmoitus?)
Each player's destinations should only be made known to them.
• Mikä on selaimesi?
Google Chrome v126

• Mitä osaa säännöistä BGA:n sovellus ei noudattanut
Each player's destinations should only be made known to them.
• Onko sääntörikkomus nähtävillä pelin toistossa? Jos kyllä, mikä on siirron numero?
It is visible on game replay, and also visible when playing a new game.

How to reproduce:
1. Start/Join a new game.
2. Open the Chrome devtools to the Network tab.
3. Refresh the game webpage.
4. Find the websocket connection that contains moves (websocket connections are easily identified by status code 101 (protocol upgrade); there should be two websockets and the one that contains moves is the second one).
5. Click on it to look at the incoming websocket packets.
6. Keep some destinations using the game UI.
7. Observe that a websocket packet will be received containing some JSON, which contains `\"type\":\"destinationsPicked\"`. This same packet also contains the pairs of cities that form each destination you picked. They look like `\"from\":6,\"to\":31`, where "6" and "31" will be replaced by the actual destinations you picked. These numbers are the cities on the map. While it isn't possible to match numbers to cities right now, it is possible once you have played enough games.
8. Go back to step 1, and repeat until you have figured out which destination each number refers to.
9. Go back to step 1, but now observe that for step 7, you actually receive a packet anytime any player chooses their cards, and the packet contains the player's username as well as the destinations that they have to connect.

Now I have not built a game on BGA before, but a quick read of boardgamearena.com/doc/Tutorial_hearts suggests that it is possible to notify just one player (to tell them their private information). If that is implementable, it should be implemented to prevent cheating.
• Mikä on selaimesi?
Google Chrome v126

• Minkä pelin toiminnon halusit suorittaa?
Each player's destinations should only be made known to them.
• Mitä yritit tehdä tämän pelitoiminnon käynnistymiseksi?
It is visible on game replay, and also visible when playing a new game.

How to reproduce:
1. Start/Join a new game.
2. Open the Chrome devtools to the Network tab.
3. Refresh the game webpage.
4. Find the websocket connection that contains moves (websocket connections are easily identified by status code 101 (protocol upgrade); there should be two websockets and the one that contains moves is the second one).
5. Click on it to look at the incoming websocket packets.
6. Keep some destinations using the game UI.
7. Observe that a websocket packet will be received containing some JSON, which contains `\"type\":\"destinationsPicked\"`. This same packet also contains the pairs of cities that form each destination you picked. They look like `\"from\":6,\"to\":31`, where "6" and "31" will be replaced by the actual destinations you picked. These numbers are the cities on the map. While it isn't possible to match numbers to cities right now, it is possible once you have played enough games.
8. Go back to step 1, and repeat until you have figured out which destination each number refers to.
9. Go back to step 1, but now observe that for step 7, you actually receive a packet anytime any player chooses their cards, and the packet contains the player's username as well as the destinations that they have to connect.

Now I have not built a game on BGA before, but a quick read of boardgamearena.com/doc/Tutorial_hearts suggests that it is possible to notify just one player (to tell them their private information). If that is implementable, it should be implemented to prevent cheating.
• Mitä tapahtui kun yritit tehdä tämän (virheilmoitus, pelin tilapalkin viesti, ...)?
• Mikä on selaimesi?
Google Chrome v126

• Missä vaiheessa peliä ongelma ilmeni (mikä oli silloinen pelin ohje)?
Each player's destinations should only be made known to them.
• Mitä tapahtui kun yritit tehdä tämän pelin toiminnon (virheilmoitus, pelin tilapalkin viesti, ...)?
It is visible on game replay, and also visible when playing a new game.

How to reproduce:
1. Start/Join a new game.
2. Open the Chrome devtools to the Network tab.
3. Refresh the game webpage.
4. Find the websocket connection that contains moves (websocket connections are easily identified by status code 101 (protocol upgrade); there should be two websockets and the one that contains moves is the second one).
5. Click on it to look at the incoming websocket packets.
6. Keep some destinations using the game UI.
7. Observe that a websocket packet will be received containing some JSON, which contains `\"type\":\"destinationsPicked\"`. This same packet also contains the pairs of cities that form each destination you picked. They look like `\"from\":6,\"to\":31`, where "6" and "31" will be replaced by the actual destinations you picked. These numbers are the cities on the map. While it isn't possible to match numbers to cities right now, it is possible once you have played enough games.
8. Go back to step 1, and repeat until you have figured out which destination each number refers to.
9. Go back to step 1, but now observe that for step 7, you actually receive a packet anytime any player chooses their cards, and the packet contains the player's username as well as the destinations that they have to connect.

Now I have not built a game on BGA before, but a quick read of boardgamearena.com/doc/Tutorial_hearts suggests that it is possible to notify just one player (to tell them their private information). If that is implementable, it should be implemented to prevent cheating.
• Mikä on selaimesi?
Google Chrome v126

• Kuvaile näyttöongelmaa. Jos sinulla on kuvankaappaus tästä bugista, voit käyttää Imgur.com:a sen lähettämiseksi. Kopioi ja liitä linkki tähän.
Each player's destinations should only be made known to them.
• Mikä on selaimesi?
Google Chrome v126

• Ole hyvä ja kopioi teksti englanniksi oman kielesi sijasta. Jos sinulla on kuvankaappaus tästä bugista, voit käyttää Imgur.com:a sen lähettämiseksi. Kopioi ja liitä linkki tähän.
Each player's destinations should only be made known to them.
• Onko tämä teksti saatavilla käännösjärjestelmässä? Jos on, onko sen käännöksestä yli 24 tuntia?
It is visible on game replay, and also visible when playing a new game.

How to reproduce:
1. Start/Join a new game.
2. Open the Chrome devtools to the Network tab.
3. Refresh the game webpage.
4. Find the websocket connection that contains moves (websocket connections are easily identified by status code 101 (protocol upgrade); there should be two websockets and the one that contains moves is the second one).
5. Click on it to look at the incoming websocket packets.
6. Keep some destinations using the game UI.
7. Observe that a websocket packet will be received containing some JSON, which contains `\"type\":\"destinationsPicked\"`. This same packet also contains the pairs of cities that form each destination you picked. They look like `\"from\":6,\"to\":31`, where "6" and "31" will be replaced by the actual destinations you picked. These numbers are the cities on the map. While it isn't possible to match numbers to cities right now, it is possible once you have played enough games.
8. Go back to step 1, and repeat until you have figured out which destination each number refers to.
9. Go back to step 1, but now observe that for step 7, you actually receive a packet anytime any player chooses their cards, and the packet contains the player's username as well as the destinations that they have to connect.

Now I have not built a game on BGA before, but a quick read of boardgamearena.com/doc/Tutorial_hearts suggests that it is possible to notify just one player (to tell them their private information). If that is implementable, it should be implemented to prevent cheating.
• Mikä on selaimesi?
Google Chrome v126

• Selitä ehdotuksesti tarkasti ja ytimekkäästi, jotta se on ymmärrettävissä niin helposti kuin mahdollista.
Each player's destinations should only be made known to them.
• Mikä on selaimesi?
Google Chrome v126

Mitä tämä raportti koskee?

Mitä tapahtui? Valitse alta

Mitä tapahtui? Valitse alta

Ennen ilmoituksen tekoa, tarkista onko sellainen jo olemassa samasta aiheesta

Tarkka kuvaus

Raportin historia

Lisää jotain tähän raporttiin

Vaihda raportin tilanne:

Ohje

Tue

Seuraa meitä