I’m creating a military game at the moment, and I would like to know if exploiters could in theory shoot wherever they want. My actual raycasts happen on the server, but it grabs from the client’s mouse hit position, would the exploiter be able to place their mouse hit position wherever they wanted anywhere on the map? I just want to know if I should bother making a sanity check to see if the raycast happens in impossible places. With my current system, the raycast originates from a physical gun model, and returns whenever it hits a wall or terrain, and I think that might be enough.
Yes, exploiters could easily manipulate the returned positions. I recommend using some sort of special function to make keys and manipulate them so the exploiters can not return false values.
Yes, any information sent to the server from the client can be manipulated.
https://developer.roblox.com/en-us/api-reference/function/Camera/WorldToViewportPoint
You can use this function to determine whether or not it would be possible for the player’s mouse to be in a specified location when the information is sent to the server.