Thanks for the interesting question.
For starters, you are correct. There will be network latency. Your application will be deployed to the
region of your choosing and respond to requests from there. Any HTTP requests between users will have to travel there and back, thus incurring this network latency. Therefore, one cannot rely on the arrival time of the HTTP request (in this case, buzzer) to determine the order.
The time one should look for is the time at which the 'button' is pressed which is best known by the client device. If your client is running in the browser for instance, you could use Javascript's
Date.now() function and provide its result when sending the 'buzz' HTTP request to your application.
As noted from MDN:
The Date.now() method returns the number of milliseconds elapsed since 1 January 1970 00:00:00 UTC.
The downside here is that the user can manually change to time set on their device to always be listed first. As far as I know, Date.now() gets its time from the device time as I've found nothing to the contrary in the
EMCAScript-262 spec about Javascript. If the user were to set their device time manually to an hour before everyone else, they will always register as the first buzzer. Barring this, most modern devices automatically sync time with accurate time servers.
If your client is running on Android devices for example, you could use calendarObject.
getTimeInMillis() to get the time in milliseconds and add the offset from calendarObject.
getTimeZone().
getOffset(calendarObject.getTimeInMillis()) to get the milliseconds since 1 January 1970 00:00:00 UTC. This again gives the same vulnerability though as manually changing the device time will affect these values. At least, with an application running on Android, you can determine if the time has been manually set by checking the
Global.AUTO_TIME property.
Given the use case you described with family and friends, I'd say this may be a simple and effective solution until someone is motivated enough to find a way to cheat or if they manually set date and time on their device for whatever reason.
Cheers.