Currently, the HTTPService is either all-in or nothing. This is something that restricts multiple developers from properly relying on the service for multiple reasons. One of them being security concerns.
Current functionalty
Currently, there is only one option associated with HTTPService, which in my opinion is not good. And that option is to either enable it, or disable it completely. Although this has worked fine, more recently we have started to see more malicious plugins, models and other assets available for developers.
If you enable HTTPService now, it allows literally anything to connect to the outside world, although this seems good at first, if you think more about it, it’s not that good at all. Imagine you install a plugin from the marketplace, and without you knowing it, it copies everything you have in your place (scripts, buildings, models etc.) and sends it to a website. Or, some malicious code that you got from a model just secretly sends information to a website. Now it probably does not sound good at all.
Solution
A solution I’ve come up with, is a domain whitelist system with customizability. This can ensure developers can trust plugins more (even though they could be malicious). I believe you should be able to set which domains you can send requests to, because currently it’s not safe to trust all assets you use, and you can set restrictions on the service.
Developers should be able to have a whitelist-only system where they have to manually add what domains are allowed.
Support! HTTPService needs some sort of request URL whitelist. It would secure the game more because unauthorized requests wouldn’t be possible to send! Backdoors or other vulnerabilities would no longer be able to notify the bad actors of infected games, making them almost useless.
The toolbox still has backdoors in some models. It’s much easier to just allow developers to impose a whitelist on outgoing requests rather than improving the AI that detects these viruses.
You could serialize the game’s models and hierarchy, but not any code. What’s more concerning however is that a backdoor could notify a group of bad actors about the infected game. Once they see it and join, the backdoor would give them a server-sided executor that could ruin the game and get the creator banned, or worse! However, if HttpService could only send requests to authorized domains, this wouldn’t be as bad of an issue.
It’s possible if a plugin does it, but you would definitely know it’s trying to do that. You need to give plugins permission to access specific sites. Scripts during run-time don’t need specific access, but they can’t read source code or even bytecode.
Earlier on another platform, some videos of people using backdoors on games with 500CCU - 1k+ CCU appeared for me and i see such was from free models, so i went into the toolbox to see if it was still easy to find backdoors, searched for “Tree House” and found a backdoor pretty quickly, the backdoor as normal attempts to hide itself in a bunch of scripts/ModuleScripts and such but eventually once it gets to its main one, if game instance isnt in studio then it will use HTTPService to let the backdoor creator/such know that the game is infected (the one i was looking into, they AI generated “legal warnings”/similar saying people who attempt to “reverse-engineer” will be receiving a “lawsuit” but i heavily doubt that and pretty sure that isnt allowed since making a model in the toolbox basically grants roblox the perms to do wtvr they want with it and such if i remember correctly so such would not be possible),
If HTTPService has a feature where domains can be whitelisted/similar then it will make it much harder for backdoor creators to function (aka would make stuff more secure which is good!).
