I gave up trying to properly fingerprint scenarios outside of Flash. Any chance of getting an API call to spit out the fingerprint when a scenario is POST'ed?
When you look at custom scenario results via the api (eg http://api.cardhunter.com/battles?type=CUSTOM ) you see they have an extra field called scenarioHash. This is a special fingerprint unique (more or less) to your scenario. You can check this fingerprint to ensure the player has played the correct scenario and hasn't tampered with any of its settings. I check this when reading results for the centurion challenge to ensure people haven't cheated.
