Confirm the player recived by a RemoteEvent

Hiya, I’m making a system in which i need a RemoteEvent to send the Player instance to the server, but I’m having a hard time thinking about how i can confirm the received Player instance. This maybe hard to understand but let me show an example:

A RemoteEvent called “ShopPurchase” exists in ReplicatedStorage:
image

A LocalScript called “CallShop” Exists in the Player instance, which has the following code:

--< Services >--
local ReplicatedStorage = game:GetService("ReplicatedStorage")
local Players = game:GetService("Players")

--< Variables >--
local ItemBuyButton = script.Parent:FindFirstChild("ItemBuyButton") -- Item to purchase
local ShopRemote = ReplicatedStorage:WaitForChild("ShopPurchase")
local Item = script.Parent:FindFirstChild("ItemID") -- Item to purchase
local Player = Players.LocalPlayer -- Local player instance

--< RemoteEvent >--
ItemBuyButton.MouseButton1Click:Connect(function()
	ShopRemote:FireServer(Player, Item) -- Fire remote
end)

And finally, a Script in ServerScriptService, which has the following code:

--< Services >--
local ReplicatedStorage = game:GetService("ReplicatedStorage")
local Players = game:GetService("Players")

--< Variables >--
local ShopRemote = ReplicatedStorage:WaitForChild("ShopPurchase")

--< Event >--
ShopRemote.OnServerEvent:Connect(function(Player, Item)
	local PlayerMoney = Player:WaitForChild("Money")
	if PlayerMoney.Value > Item.Cost.Value then
		PlayerMoney.Value = PlayerMoney.Value - Item.Cost.Value
		local PurchasedItem = Item:Clone()
		PurchasedItem.Parent = Player.Backpack
	else return end
end)

Now that we have a basic understanding, my question is, how do i stop an exploiter from just firing the RemoteEvent with another Player’s instance like this?:

ShopRemote:FireServer(Players.FindFirstChild("GamerKid123", Item)

Apologies in advance for grammar/spelling mistakes, I’m very tired.

You can’t fire other people’s Events. It would just add that player as an argument to you firing the event. That is unless each player has a specific event for themselves.

Is right. But:

Is wrong. The player instance is automatically passed into the first function (as the player who is invoking the event).

ShopRemote:FireServer(Item)

Would instead be correct.

There’s no way to spoof the Player instance passed, because it’s added automatically by Roblox.

1 Like