#129385: "It is possible to see other players' destinations by inspecting the websocket connection"

• Kopieer en plak alsjeblieft de foutboodschap die je op je scherm ziet, indien van toepassing.
Each player's destinations should only be made known to them.
• Leg uit wat je wilde doen, wat je deed en wat er gebeurde
It is visible on game replay, and also visible when playing a new game.

How to reproduce:
1. Start/Join a new game.
2. Open the Chrome devtools to the Network tab.
3. Refresh the game webpage.
4. Find the websocket connection that contains moves (websocket connections are easily identified by status code 101 (protocol upgrade); there should be two websockets and the one that contains moves is the second one).
5. Click on it to look at the incoming websocket packets.
6. Keep some destinations using the game UI.
7. Observe that a websocket packet will be received containing some JSON, which contains `\"type\":\"destinationsPicked\"`. This same packet also contains the pairs of cities that form each destination you picked. They look like `\"from\":6,\"to\":31`, where "6" and "31" will be replaced by the actual destinations you picked. These numbers are the cities on the map. While it isn't possible to match numbers to cities right now, it is possible once you have played enough games.
8. Go back to step 1, and repeat until you have figured out which destination each number refers to.
9. Go back to step 1, but now observe that for step 7, you actually receive a packet anytime any player chooses their cards, and the packet contains the player's username as well as the destinations that they have to connect.

Now I have not built a game on BGA before, but a quick read of boardgamearena.com/doc/Tutorial_hearts suggests that it is possible to notify just one player (to tell them their private information). If that is implementable, it should be implemented to prevent cheating.
• Welke browser gebruik je?
Google Chrome v126

• Kopieer en plak alsjeblieft de tekst die in het Engels wordt getoond in plaats van in jouw taal. Als je een schermafbeelding van deze bug hebt (goede gewoonte), kun je Imgur.com gebruiken om deze te uploaden, de link kopiëren en hier plakken.
Each player's destinations should only be made known to them.
• Is deze tekst beschikbaar in het vertaalsysteem? Zo ja, is deze meer dan 24 uur geleden vertaald?
It is visible on game replay, and also visible when playing a new game.

How to reproduce:
1. Start/Join a new game.
2. Open the Chrome devtools to the Network tab.
3. Refresh the game webpage.
4. Find the websocket connection that contains moves (websocket connections are easily identified by status code 101 (protocol upgrade); there should be two websockets and the one that contains moves is the second one).
5. Click on it to look at the incoming websocket packets.
6. Keep some destinations using the game UI.
7. Observe that a websocket packet will be received containing some JSON, which contains `\"type\":\"destinationsPicked\"`. This same packet also contains the pairs of cities that form each destination you picked. They look like `\"from\":6,\"to\":31`, where "6" and "31" will be replaced by the actual destinations you picked. These numbers are the cities on the map. While it isn't possible to match numbers to cities right now, it is possible once you have played enough games.
8. Go back to step 1, and repeat until you have figured out which destination each number refers to.
9. Go back to step 1, but now observe that for step 7, you actually receive a packet anytime any player chooses their cards, and the packet contains the player's username as well as the destinations that they have to connect.

Now I have not built a game on BGA before, but a quick read of boardgamearena.com/doc/Tutorial_hearts suggests that it is possible to notify just one player (to tell them their private information). If that is implementable, it should be implemented to prevent cheating.
• Welke browser gebruik je?
Google Chrome v126

• Gelieve jouw suggestie precies en beknopt uit te leggen zodat het zo makkelijk mogelijk is om te begrijpen wat je bedoelt.
Each player's destinations should only be made known to them.
• Welke browser gebruik je?
Google Chrome v126

• Wat stond op het scherm toen je geblokkeerd was (Leeg scherm? Een deel van de spelinterface? Foutboodschap?)
Each player's destinations should only be made known to them.
• Welke browser gebruik je?
Google Chrome v126

• Met welk onderdeel van de regels is geen rekening gehouden bij de BGA-versie?
Each player's destinations should only be made known to them.
• Is de inbreuk op de spelregels zichtbaar in de spelherhaling? Indien ja, bij welk zetnummer?
It is visible on game replay, and also visible when playing a new game.

How to reproduce:
1. Start/Join a new game.
2. Open the Chrome devtools to the Network tab.
3. Refresh the game webpage.
4. Find the websocket connection that contains moves (websocket connections are easily identified by status code 101 (protocol upgrade); there should be two websockets and the one that contains moves is the second one).
5. Click on it to look at the incoming websocket packets.
6. Keep some destinations using the game UI.
7. Observe that a websocket packet will be received containing some JSON, which contains `\"type\":\"destinationsPicked\"`. This same packet also contains the pairs of cities that form each destination you picked. They look like `\"from\":6,\"to\":31`, where "6" and "31" will be replaced by the actual destinations you picked. These numbers are the cities on the map. While it isn't possible to match numbers to cities right now, it is possible once you have played enough games.
8. Go back to step 1, and repeat until you have figured out which destination each number refers to.
9. Go back to step 1, but now observe that for step 7, you actually receive a packet anytime any player chooses their cards, and the packet contains the player's username as well as the destinations that they have to connect.

Now I have not built a game on BGA before, but a quick read of boardgamearena.com/doc/Tutorial_hearts suggests that it is possible to notify just one player (to tell them their private information). If that is implementable, it should be implemented to prevent cheating.
• Welke browser gebruik je?
Google Chrome v126

• Welke spelactie wilde je uitvoeren?
Each player's destinations should only be made known to them.
• Wat probeerde je te doen om deze spelactie te laten optreden?
It is visible on game replay, and also visible when playing a new game.

How to reproduce:
1. Start/Join a new game.
2. Open the Chrome devtools to the Network tab.
3. Refresh the game webpage.
4. Find the websocket connection that contains moves (websocket connections are easily identified by status code 101 (protocol upgrade); there should be two websockets and the one that contains moves is the second one).
5. Click on it to look at the incoming websocket packets.
6. Keep some destinations using the game UI.
7. Observe that a websocket packet will be received containing some JSON, which contains `\"type\":\"destinationsPicked\"`. This same packet also contains the pairs of cities that form each destination you picked. They look like `\"from\":6,\"to\":31`, where "6" and "31" will be replaced by the actual destinations you picked. These numbers are the cities on the map. While it isn't possible to match numbers to cities right now, it is possible once you have played enough games.
8. Go back to step 1, and repeat until you have figured out which destination each number refers to.
9. Go back to step 1, but now observe that for step 7, you actually receive a packet anytime any player chooses their cards, and the packet contains the player's username as well as the destinations that they have to connect.

Now I have not built a game on BGA before, but a quick read of boardgamearena.com/doc/Tutorial_hearts suggests that it is possible to notify just one player (to tell them their private information). If that is implementable, it should be implemented to prevent cheating.
• Wat gebeurde er toen je dit probeerde te doen (foutboodschap, melding op de statusbalk van het spel, ...)?
• Welke browser gebruik je?
Google Chrome v126

• In welke fase van het spel deed het probleem zich voor (wat was de huidige spelinstructie)?
Each player's destinations should only be made known to them.
• Wat gebeurde toen je deze spelactie probeerde (foutboodschap, melding op de statusbalk van het spel, ...)?
It is visible on game replay, and also visible when playing a new game.

How to reproduce:
1. Start/Join a new game.
2. Open the Chrome devtools to the Network tab.
3. Refresh the game webpage.
4. Find the websocket connection that contains moves (websocket connections are easily identified by status code 101 (protocol upgrade); there should be two websockets and the one that contains moves is the second one).
5. Click on it to look at the incoming websocket packets.
6. Keep some destinations using the game UI.
7. Observe that a websocket packet will be received containing some JSON, which contains `\"type\":\"destinationsPicked\"`. This same packet also contains the pairs of cities that form each destination you picked. They look like `\"from\":6,\"to\":31`, where "6" and "31" will be replaced by the actual destinations you picked. These numbers are the cities on the map. While it isn't possible to match numbers to cities right now, it is possible once you have played enough games.
8. Go back to step 1, and repeat until you have figured out which destination each number refers to.
9. Go back to step 1, but now observe that for step 7, you actually receive a packet anytime any player chooses their cards, and the packet contains the player's username as well as the destinations that they have to connect.

Now I have not built a game on BGA before, but a quick read of boardgamearena.com/doc/Tutorial_hearts suggests that it is possible to notify just one player (to tell them their private information). If that is implementable, it should be implemented to prevent cheating.
• Welke browser gebruik je?
Google Chrome v126

• Beschrijf alsjeblieft het probleem met de beeldweergave. Als je een schermafbeelding van deze bug hebt (goede gewoonte), kun je Imgur.com gebruiken om deze te uploaden, de link kopiëren en hier plakken.
Each player's destinations should only be made known to them.
• Welke browser gebruik je?
Google Chrome v126

• Kopieer en plak alsjeblieft de tekst die in het Engels wordt getoond in plaats van in jouw taal. Als je een schermafbeelding van deze bug hebt (goede gewoonte), kun je Imgur.com gebruiken om deze te uploaden, de link kopiëren en hier plakken.
Each player's destinations should only be made known to them.
• Is deze tekst beschikbaar in het vertaalsysteem? Zo ja, is deze meer dan 24 uur geleden vertaald?
It is visible on game replay, and also visible when playing a new game.

How to reproduce:
1. Start/Join a new game.
2. Open the Chrome devtools to the Network tab.
3. Refresh the game webpage.
4. Find the websocket connection that contains moves (websocket connections are easily identified by status code 101 (protocol upgrade); there should be two websockets and the one that contains moves is the second one).
5. Click on it to look at the incoming websocket packets.
6. Keep some destinations using the game UI.
7. Observe that a websocket packet will be received containing some JSON, which contains `\"type\":\"destinationsPicked\"`. This same packet also contains the pairs of cities that form each destination you picked. They look like `\"from\":6,\"to\":31`, where "6" and "31" will be replaced by the actual destinations you picked. These numbers are the cities on the map. While it isn't possible to match numbers to cities right now, it is possible once you have played enough games.
8. Go back to step 1, and repeat until you have figured out which destination each number refers to.
9. Go back to step 1, but now observe that for step 7, you actually receive a packet anytime any player chooses their cards, and the packet contains the player's username as well as the destinations that they have to connect.

Now I have not built a game on BGA before, but a quick read of boardgamearena.com/doc/Tutorial_hearts suggests that it is possible to notify just one player (to tell them their private information). If that is implementable, it should be implemented to prevent cheating.
• Welke browser gebruik je?
Google Chrome v126

• Gelieve jouw suggestie precies en beknopt uit te leggen zodat het zo makkelijk mogelijk is om te begrijpen wat je bedoelt.
Each player's destinations should only be made known to them.
• Welke browser gebruik je?
Google Chrome v126

Waarover gaat dit rapport?

Wat is er gebeurd? Selecteer uit het onderstaande

Wat is er gebeurd? Selecteer uit het onderstaande

Controleer of er al een rapport is over hetzelfde onderwerp

Gedetailleerde beschrijving

Rapportgeschiedenis

Dit rapport aanvullen

Wijzig rapportstatus naar:

Help

Draag bij

Volg ons