I'm creating an web-application that has a simple javascript game in it. Once the player finished playing the game the high-score is sent to the server and saved.

After a specific period the player with the best score receives a prize.

Is there a way to send the high-score securely and prevent the client sending 'false' high-scores? 

Currently we are using:


Https.
Server random token before each game and sent after the game is finished alongside the score.


The server can't fully trust any data it receives from the client, so validating high scores is difficult.

Here are a few options:


Obfuscate the client-side code and traffic to the server. This is the easiest option - it will still be possible to cheat, but probably won't be worth anyone's time.
Send a full or partial replay of the game to the server for validation. The player's moves can be run on the server to determine the legitimate score. This will work for some games and not for others.
Move the game logic and validation to the server. The client simply relays each move to the server, where it is validated and the game state updated.


It comes down to how your game works, how likely it is that people will cheat, and how much you care if they do.
