Hey all, I currently have an emote system in my game that creates a “EmoteController” class on the client. I have a problem with the way this system works though, it’s insecure. Basically, I’m trying to implement a sync system between players where when you play an emote, a proximity prompt enables itself so you can simply press e to sync an emote. The problem occurs when you actually try to enable the proximity prompt though, as you can’t enable them on the client as it won’t show up for everybody else, and so I thought to use remove events to enable them on the server, but anybody can just fire that remote event and break the system entirely. I’m stuck because the server doesn’t have any info on whether the client is actually playing an emote or not, and I don’t know how to implement that.
This would not be hard at all if I even did just a portion of this on the server, but I thought it was probably better to handle emotes / animations on the client rather than the server, so does anybody know a way I can still do that but also fix this security issue, or do I have to rewrite my code?
why dont you just use a remote event, and in the script where it fires, make a variable called isPlaying or something, and then toggle it when someone syncs with you or then stops, and since its on the server, if isPlaying is true then it just hides the proximity prompt for everyone, and when its off, it shows it for everyone
if im understanding you right, what if somebody were to, with malicious intent, fire that remote event separately, what checks on the server would verify that an emote is actually playing to sync with?
how about checking if the isPlaying variable is active, if someone fires the event even though the variable shouldnt allow it, then that person it obviously firing it through scripts, and make sure it has a parameter of maybe the playersUserID to confirm that its a player firing it, and to assure theyre firing it to a player who is actively able to sync, if someone fires the event and that user is not in the game, or that user is not actively able to sync, then its obviously through scripts, theres a few ways but i think just using the first one is fine
yes… but the point is that in the way I do my script, I handle emote playing on the client, which means that the server won’t have access to that info of whether a player is acutally playing an emote. This is why I was asking if there was a way I could do this without rewriting my code to be partially on the server.
well in the server script where you would set the isplaying variable, you could just check in the same script if isplaying is already active, i just noticed you said without being partially on the server
tbh if u dont want it being partially on the server it wont really be safe from hackers, the only way to really secure things is to do things through the server since hackers can only access the client, so its either rlly functionallity and optimization or security
And how would this IsPlaying variable be set? through a remote event? because then that same problem of security would surface again where an exploiter could just fire with the args that they are playing an emote when they aren’t.
it could either be a boolean value in each player maybe just to make sure it works for each character, or it could just be set through the server script