Spoof-proof Time in Javascript

Question

I'm working on a web app which must measure the time user needs to do something. I can't simply use javascript time object, because the user may change system time to cheat and fool the app. I'd need some way to prevent this.

Answer 1

I would make the web app send heartbeats or any other form of signals back to the server side. Then you can construct some metrics like duration = end - start

Accounting for the round trip client-server communication, this isn't suitable for ms resolution measurements, obviously.

Note : It's not a good idea to just read the time from a "trusted" web service into your client side app, you can't really guarantee the app wouldn't temper with it. (One of cardinal rules in client side dealings, is to not trust its input, e.g. for validation, you still need server-side validation on top). However if you just send signals to the server, log its timestamp using the server's clock, you are a lot safer.

Answer 2

Calculate time on the server side.

The client user cannot futz with that (at least they should not be able to)