Backend not verifying client requests

[FluffyDiscord]

I noticed, that server simply takes what client requests, and does that. I just added myself 39 gold, by re-sending websocket payload.

This probably also works for cards and other stuff.

Are there any plans to actually verify, if these requests are valid? Game state is basically controlled all at client side.

[serprex]

That's right

Would pretty much need to rework everything to work serverside to address this

[FluffyDiscord]

I guess that would need to either mirror logic on server side, or implement some kind of action validation. Welp