Add interaction attestation: click/input tracking to detect direct API abuse

[PeaStew]

Problem

Users are bypassing the game interface entirely and hitting backend APIs directly to collect objects and earn location points without actually playing. This is the primary bot/abuse vector and cannot be solved by traditional auth alone — the attacker has valid credentials.

Proposed Solution: Interaction Attestation

Require proof of genuine UI interaction alongside API requests. Requests without interaction evidence are flagged or rejected.

Architecture

Game Client (iframe/frontend)
  ├── Records click/touch events with timestamps + coordinates
  ├── Records scroll, mouse movement, keystrokes (heuristics)
  ├── Bundles into a signed interaction proof
  └── Attaches proof to API requests (header or body)

Backend (hot_storage / game API)
  ├── Validates interaction proof on point-earning endpoints
  ├── Rejects requests with missing/empty interaction data
  ├── Flags requests with suspicious patterns (see below)
  └── Logs for offline analysis

Interaction Proof Payload

{
  "clicks": [
    {"x": 142, "y": 389, "t": 1713012345123, "target": "object_a3f2"},
    {"x": 501, "y": 200, "t": 1713012346456, "target": "location_b1"}
  ],
  "mousePath": [[100,200,1713012344000], [120,210,1713012344050], ...],
  "sessionStart": 1713012340000,
  "viewportSize": [1920, 1080],
  "nonce": "abc123",
  "signature": "<HMAC of payload with session-bound key>"
}

Detection Heuristics

Signal	Legitimate User	Bot
Click count before action	Multiple clicks/movements	0 or exactly 1
Click coordinates	Varied, natural distribution	Identical, grid-aligned, or (0,0)
Time between clicks	Variable (200ms-5s)	Uniform or <50ms
Mouse movement	Curved, jittery paths	Straight lines or absent
Viewport/UA consistency	Matches device	Headless defaults (800x600)
Session duration before action	Seconds to minutes of browsing	Immediate API call
Click target validity	Matches rendered game objects	Random or missing targets

Implementation Steps

1. Client-side: Add lightweight event listener in the game iframe that buffers click/touch events (cap at last 50 events to limit payload size)
2. Signing: Generate a per-session HMAC key on auth; sign the interaction payload client-side so it can't be trivially fabricated by replaying
3. Middleware: Add interactionProof validation middleware on all point-earning / object-collection endpoints
4. Soft launch: Start in audit mode (log but don't reject) to baseline legitimate user behavior before enforcing
5. Escalation: Requests with no interaction proof → reject. Requests with suspicious patterns → flag for review + temporary soft-ban

Important Considerations

• This is not foolproof — a sophisticated attacker can instrument a headless browser to generate fake clicks. But it raises the bar significantly from "curl loop" to "full browser automation with coordinate generation."
• Combine with other layers (rate limiting, device fingerprinting) for defense in depth
• The interaction log doubles as UX analytics data

References

• Google reCAPTCHA v3 uses similar behavioral signals internally
• Arkose Labs / Shape Security use interaction attestation commercially