Thanks. Right now, scores are kept independently by each client and never pushed to the server. This is simply to prevent cheating; cunning players could update their score without winning (or even playing a game), and the change would be pushed to their opponent.

I need to work out how to store and validate scores in Firebase to prevent cheating (which should be possible with their security rules, I think).

I don't know how it currently works, but this is how I'd do it:

    1. Clients notify server they want to play a/another game
    2. Clients both pick their 'answer' (spock/lizard/rock/...)
    3. Server only tells what choice the other made once both players submitted
    4. Server computes who wins, and updates scores accordingly

This does require a stateful server, but I don't think it's possible to make it cheat-proof with only clients.

Thanks for the input. Steps 1-3 are how it currently works. Step 4 is problematic because the Firebase server cannot compute who wins; that has to be done on the client.

I think I can configure Firebase to validate scores based on some precondition (i.e. 'only allow this value to be increased by one if both players have chosen and declared'). Then clients would reset their choices immediately and scores would be 'locked-in' until the next victory condition is met. That will prevent basic attempts to cheat, but I need to look into the docs to see if I could be smarter about it.