Feature request: [SECURITY] prevent client side forgery of game results and ui daily task updates. #580

What do you want to see in the API?

Currently the API trusts that the requests to UIDailyTask updates and Battle results are legitimate. But these endpoints are easily abusable by a logged in player. With a valid JWT you could send requests to these endpoints as much as you want so you could fake won battles and completed tasks. To prevent this we need some kind of validation system between the game and API.

How do you think this should work?

• The Game and Api should share a secret key.
• When game completes an action (battle or task) the game creates an JWT containing the relevant DTO as the payload and signs the token with the shared secret.
• The Game should also add a session ID (randomly generated value) to the token so Api can validate that the same token isn't used multiple times.
• This JWT should be required for requests to these endpoints ( /gameData/battle, /dailyTasks/uiDailyTask).
• used Session IDs should be saved on API to redis with TTL matching with the token.
• API verifies the JWT signature using the shared secret and check if session ID exists in redis.