I'm creating an online game and I was thinking about a way to handle login and was wondering if the following has any major issues that anyone could see.
1. Have a launcher app (node.js) point to a webpage that shows news about the game. On launch it also returns the latest client version from the server and the launcher app then checks the clients version on disk (since it's node.js it has these rights). If different then download the new client files.
2. This would also have a login form on the page. A user would log into this site. The site would then validate id/pw and give a guid session id and add it to the games database under that client as kind of an access token and return that token to the client. Maybe also returns the game server to connect to?
3. After login is validated the launcher app would shell out to the actual game exe passing the token, the username (and game server address) as a command line argument.
4. The game exe connects to the game server using my network library (RakNet in this case) and sends the access token & username which is checked in the database to see if any record matches both those values in the users table. If it does then the game exe can now play the game. If it doesn't the game exe disconnects and doesn't allow the player to play the game.
I've never seen the launcher app be the login for the game. That's usually done in the game itself, but is there anything wrong with having the launcher app being the login process for the game and getting an "access token" to pass to the game exe? Everything has it's flaws but is there any major security issues that wouldn't exist with any type of login system anyway with this way of doing it?
