Avoiding exploits in daily login bonus

Hi all.
I’m going to make a daily login bonus system. But storing os.time and checking it each login is exploitable. (change time on your system and boom, instant login bonus)
Sooo… is there a “global” time keeping system i can rely on instead?

How is it exploitable? If you’re calling os.time on the server it should stay consistent as far as I know

So if i understand correctly.
You are saying that os.time when called by a server script will always be consistent, and if called by local scripts it calls user os time?

If you store the os.time on the Server, then there should be no issue with exploting?

1 Like

Yes, I believe that’s how it works. You should be checking stuff like that on the server

1 Like

@heII_ish

unchanged time:
image
set to midnight:
image

Reads same time…
Soooo… now what?

The server is a local server which uses your computers time, try publishing the game and see what happens.

2 Likes

os.time always tries to tell the same time no matter if it is from the server or client. The difference is that if you are trusting the client to give you the time info, then you are allowing exploits.

If you mean to get the local time of the current machine, you are looking for tick.

Also note that it is impossible for multiple machines to perfectly tell the same time, but the gap should not be noticeably big, although it can normally reach up to seconds in difference.

I think os.time is relative to the computer’s time locally

you could try using a time website then seeing if that time is a certain time away from when the user last claimed it, or use a datastore to store the time data and when the player goes in game to let it tick, or use the aforementioned method.

Yeah using time from a website google can be more reliable since it’s well google. Plus according to rek_kie it should be more accurate if that’s a concern of the person reading this, and it should be simple to set up using the synced time module provided in the tutorial if you want to use that method.

But yeah do it on the server of course.

Yeah, I forgot the website for the time; so follow as he says.