Client-sided cooldowns?

Help and Feedback Scripting Support
#1

Thanks for reading in advance.

In a fighting game with spells/abilities that utilize cooldowns, how do I check to make sure the client abiding the cooldowns of their attacks? I only know of a few solutions, but each have workarounds if what people say about exploiting client-side code is to be believed. If the client has complete control over the data provided to them on their end, I see it as a difficult task to force the client to properly abide their cooldown periods.

I could:

  • S: Process cooldowns server-side and simply tell the server when the client is done attacking

  • E: BUT an exploiter could simply remove the pre-cast check to see if the ability is useable

  • S: Fire a remote every time the user casts something to help the server keep track

  • E: BUT an exploiter could simply choose to not fire this remote

  • S: Process all ability-related functions server-side and only allow the client to animate the character

  • E: BUT Latency would become an issue as I tend to rely on client-sided hit-detection with server verification

…The list goes on. The short version is, I don’t see a practical way to ensure that the client isn’t spamming their ability functions, outside of attaching a server-sided check to whatever game logic the client is allowed to process (hit requests), as a determined exploiter could simply ignore whatever checks I present to the client to filter their casting.

If anyone knows something I’m missing or should be doing, I’d appreciate you letting me know. Thanks!

1 Like
#2

I think the third option is better because although you find trouble and or you are not used to it, you can always adapt to it. In addition, having the game exploit proof would be priority in this case. People won’t want to play a game with a lot of exploiters.

#3

I’m relatively new to detecting exploits, but you could possibly check if an external script is being injected into the game.

The client could just send a request to the server and only if it received an okay, then the animation would fire.

I don’t think latency should be an issue with the third option, however don’t take my word for it and it’s probably best to do a test.

Sadly there will never be a way to fully prevent exploiters as if the exploiter can open the game on their computer, they can access the game.

#4

Do checks on the client and then on the server, when they use an ability you can set a variable like LastAttack and set that to tick(). Then just check to make sure the time between tick() and your LastAttack is greater than or equal to whatever you want the cooldown time to be.

So in short your third option is probably the best. Have the server do the checking logic to make sure they arent exceeding any limits. You can also do the same check on the client when the ability is attempting to be used to make sure the players aren’t causing the remote to be fired more than it needs to be. Then just do all your animations and rendering on the clients if the ability was used properly passing all checks.

3 Likes