#129385: "It is possible to see other players' destinations by inspecting the websocket connection"

• Please copy/paste the error message you see on your screen, if any.
Each player's destinations should only be made known to them.
• Please explains what you wanted to do, what you do and what happened
It is visible on game replay, and also visible when playing a new game.

How to reproduce:
1. Start/Join a new game.
2. Open the Chrome devtools to the Network tab.
3. Refresh the game webpage.
4. Find the websocket connection that contains moves (websocket connections are easily identified by status code 101 (protocol upgrade); there should be two websockets and the one that contains moves is the second one).
5. Click on it to look at the incoming websocket packets.
6. Keep some destinations using the game UI.
7. Observe that a websocket packet will be received containing some JSON, which contains `\"type\":\"destinationsPicked\"`. This same packet also contains the pairs of cities that form each destination you picked. They look like `\"from\":6,\"to\":31`, where "6" and "31" will be replaced by the actual destinations you picked. These numbers are the cities on the map. While it isn't possible to match numbers to cities right now, it is possible once you have played enough games.
8. Go back to step 1, and repeat until you have figured out which destination each number refers to.
9. Go back to step 1, but now observe that for step 7, you actually receive a packet anytime any player chooses their cards, and the packet contains the player's username as well as the destinations that they have to connect.

Now I have not built a game on BGA before, but a quick read of boardgamearena.com/doc/Tutorial_hearts suggests that it is possible to notify just one player (to tell them their private information). If that is implementable, it should be implemented to prevent cheating.
• What is your browser?
Google Chrome v126

• Please copy/paste the text displayed in English instead of your language. If you have a screenshot of this bug (good practice), you can use Imgur.com to upload it and copy/paste the link here.
Each player's destinations should only be made known to them.
• Is this text available in the translation system? If yes, has it been translated for more than 24 hours?
It is visible on game replay, and also visible when playing a new game.

How to reproduce:
1. Start/Join a new game.
2. Open the Chrome devtools to the Network tab.
3. Refresh the game webpage.
4. Find the websocket connection that contains moves (websocket connections are easily identified by status code 101 (protocol upgrade); there should be two websockets and the one that contains moves is the second one).
5. Click on it to look at the incoming websocket packets.
6. Keep some destinations using the game UI.
7. Observe that a websocket packet will be received containing some JSON, which contains `\"type\":\"destinationsPicked\"`. This same packet also contains the pairs of cities that form each destination you picked. They look like `\"from\":6,\"to\":31`, where "6" and "31" will be replaced by the actual destinations you picked. These numbers are the cities on the map. While it isn't possible to match numbers to cities right now, it is possible once you have played enough games.
8. Go back to step 1, and repeat until you have figured out which destination each number refers to.
9. Go back to step 1, but now observe that for step 7, you actually receive a packet anytime any player chooses their cards, and the packet contains the player's username as well as the destinations that they have to connect.

Now I have not built a game on BGA before, but a quick read of boardgamearena.com/doc/Tutorial_hearts suggests that it is possible to notify just one player (to tell them their private information). If that is implementable, it should be implemented to prevent cheating.
• What is your browser?
Google Chrome v126

• Please explain your suggestion precisely and concisely so that it's as easy as possible to understand what you mean.
Each player's destinations should only be made known to them.
• What is your browser?
Google Chrome v126

• What was displayed on the screen when you were blocked (Blank screen? Part of the game interface? Error message?)
Each player's destinations should only be made known to them.
• What is your browser?
Google Chrome v126

• Which part of the rules was not respected by the BGA adaptation
Each player's destinations should only be made known to them.
• Is the rules violation visible on game replay? If yes, at which move number?
It is visible on game replay, and also visible when playing a new game.

How to reproduce:
1. Start/Join a new game.
2. Open the Chrome devtools to the Network tab.
3. Refresh the game webpage.
4. Find the websocket connection that contains moves (websocket connections are easily identified by status code 101 (protocol upgrade); there should be two websockets and the one that contains moves is the second one).
5. Click on it to look at the incoming websocket packets.
6. Keep some destinations using the game UI.
7. Observe that a websocket packet will be received containing some JSON, which contains `\"type\":\"destinationsPicked\"`. This same packet also contains the pairs of cities that form each destination you picked. They look like `\"from\":6,\"to\":31`, where "6" and "31" will be replaced by the actual destinations you picked. These numbers are the cities on the map. While it isn't possible to match numbers to cities right now, it is possible once you have played enough games.
8. Go back to step 1, and repeat until you have figured out which destination each number refers to.
9. Go back to step 1, but now observe that for step 7, you actually receive a packet anytime any player chooses their cards, and the packet contains the player's username as well as the destinations that they have to connect.

Now I have not built a game on BGA before, but a quick read of boardgamearena.com/doc/Tutorial_hearts suggests that it is possible to notify just one player (to tell them their private information). If that is implementable, it should be implemented to prevent cheating.
• What is your browser?
Google Chrome v126

• Which was the game action you wanted to do?
Each player's destinations should only be made known to them.
• What do you try to do to trigger this game action?
It is visible on game replay, and also visible when playing a new game.

How to reproduce:
1. Start/Join a new game.
2. Open the Chrome devtools to the Network tab.
3. Refresh the game webpage.
4. Find the websocket connection that contains moves (websocket connections are easily identified by status code 101 (protocol upgrade); there should be two websockets and the one that contains moves is the second one).
5. Click on it to look at the incoming websocket packets.
6. Keep some destinations using the game UI.
7. Observe that a websocket packet will be received containing some JSON, which contains `\"type\":\"destinationsPicked\"`. This same packet also contains the pairs of cities that form each destination you picked. They look like `\"from\":6,\"to\":31`, where "6" and "31" will be replaced by the actual destinations you picked. These numbers are the cities on the map. While it isn't possible to match numbers to cities right now, it is possible once you have played enough games.
8. Go back to step 1, and repeat until you have figured out which destination each number refers to.
9. Go back to step 1, but now observe that for step 7, you actually receive a packet anytime any player chooses their cards, and the packet contains the player's username as well as the destinations that they have to connect.

Now I have not built a game on BGA before, but a quick read of boardgamearena.com/doc/Tutorial_hearts suggests that it is possible to notify just one player (to tell them their private information). If that is implementable, it should be implemented to prevent cheating.
• What happened when you try to do this (error message, game status bar message, ...)?
• What is your browser?
Google Chrome v126

• At which step of the game did the problem occurs (what was the current game instruction)?
Each player's destinations should only be made known to them.
• What happened when you try to do a game action (error message, game status bar message, ...)?
It is visible on game replay, and also visible when playing a new game.

How to reproduce:
1. Start/Join a new game.
2. Open the Chrome devtools to the Network tab.
3. Refresh the game webpage.
4. Find the websocket connection that contains moves (websocket connections are easily identified by status code 101 (protocol upgrade); there should be two websockets and the one that contains moves is the second one).
5. Click on it to look at the incoming websocket packets.
6. Keep some destinations using the game UI.
7. Observe that a websocket packet will be received containing some JSON, which contains `\"type\":\"destinationsPicked\"`. This same packet also contains the pairs of cities that form each destination you picked. They look like `\"from\":6,\"to\":31`, where "6" and "31" will be replaced by the actual destinations you picked. These numbers are the cities on the map. While it isn't possible to match numbers to cities right now, it is possible once you have played enough games.
8. Go back to step 1, and repeat until you have figured out which destination each number refers to.
9. Go back to step 1, but now observe that for step 7, you actually receive a packet anytime any player chooses their cards, and the packet contains the player's username as well as the destinations that they have to connect.

Now I have not built a game on BGA before, but a quick read of boardgamearena.com/doc/Tutorial_hearts suggests that it is possible to notify just one player (to tell them their private information). If that is implementable, it should be implemented to prevent cheating.
• What is your browser?
Google Chrome v126

• Please describe the display issue. If you have a screenshot of this bug (good practice), you can use Imgur.com to upload it and copy/paste the link here.
Each player's destinations should only be made known to them.
• What is your browser?
Google Chrome v126

• Please copy/paste the text displayed in English instead of your language. If you have a screenshot of this bug (good practice), you can use Imgur.com to upload it and copy/paste the link here.
Each player's destinations should only be made known to them.
• Is this text available in the translation system? If yes, has it been translated for more than 24 hours?
It is visible on game replay, and also visible when playing a new game.

How to reproduce:
1. Start/Join a new game.
2. Open the Chrome devtools to the Network tab.
3. Refresh the game webpage.
4. Find the websocket connection that contains moves (websocket connections are easily identified by status code 101 (protocol upgrade); there should be two websockets and the one that contains moves is the second one).
5. Click on it to look at the incoming websocket packets.
6. Keep some destinations using the game UI.
7. Observe that a websocket packet will be received containing some JSON, which contains `\"type\":\"destinationsPicked\"`. This same packet also contains the pairs of cities that form each destination you picked. They look like `\"from\":6,\"to\":31`, where "6" and "31" will be replaced by the actual destinations you picked. These numbers are the cities on the map. While it isn't possible to match numbers to cities right now, it is possible once you have played enough games.
8. Go back to step 1, and repeat until you have figured out which destination each number refers to.
9. Go back to step 1, but now observe that for step 7, you actually receive a packet anytime any player chooses their cards, and the packet contains the player's username as well as the destinations that they have to connect.

Now I have not built a game on BGA before, but a quick read of boardgamearena.com/doc/Tutorial_hearts suggests that it is possible to notify just one player (to tell them their private information). If that is implementable, it should be implemented to prevent cheating.
• What is your browser?
Google Chrome v126

• Please explain your suggestion precisely and concisely so that it's as easy as possible to understand what you mean.
Each player's destinations should only be made known to them.
• What is your browser?
Google Chrome v126

What is this report about?

What happened ? Please select from below

What happened ? Please select from below

Please check if there is already a report on the same subject

Detailed description

Report history

Add something to this report

Change report status to:

LB_HELP

Contribute

Follow us