About a year ago we enabled a feature which allowed you to send data from one server to another during a teleport. Since then, we’ve realized it’s not super-easy to verify where this data came from so this morning we enabled a useful update to make this easier!
SourceGameId will now be present alongside SourcePlaceId when calling GetJoinData. This means you no longer need to keep track of all the places in your game, you can just check that GameId matches your current game.
Before:
local whitelist = { 1818, 25415 }
local function getTeleportData(player)
local joinData = player:GetJoinData()
for i = 1, #whitelist do
if whitelist[i] == joinData.SourcePlaceId then
return joinData
end
end
return nil
end
After:
local function getTeleportData(player)
local joinData = player:GetJoinData()
if joinData.SourceGameId == game.GameId then
return joinData
end
return nil
end
As always when dealing with TeleportService, it’s important to remember Roblox’s botched security model with teleport data:
However, as this data is transmitted by the client, it not 100% secure. Although the user cannot modify this data it is possible for them to view it or insert data from a previous teleport.
I hate that image so much but I love it at the same time. Not sure what the flags are for, the only thing spammy in your message is the image (which is amazing).
As for the post,
This is definitely an awesome change! I was previously doing some hacky checks for place ownership. GetJoinData is by far one of the most useful TeleportService features.
Also P.S. here’s a tip for some extra security: Use sha256 hashing with a strong salt (64-128 characters is strong). Include the hash in your request and double check the data. You can just serialize it to JSON after deleting the hash value in the table. I’d also recommend including teleport time in your data so that you can have requests expire (to solve the issue of old teleport data being used).
If you’re wondering what a salt is it’s pretty much just some extra data appended/prepending to the text to hash.
Edit: I tried to reply to a deleted message and now I’ve replied to myself. Congrats to my school for having a bad enough connection to break reality and create a circular reply.
Curious though, would someone be able to teleport their players to a place in my game’s sub places using Reserved servers? if so why is this supported / would it be possible to set a whitelist on who can teleport to these places.
Generally if it’s being announced it’s always live, otherwise they specify that in the post. Someone at least cannot teleport to reserved servers in your game without the key. There are also probably restrictions on teleporting to reserved servers from places not owned by you. As for non-reserved servers you can definitely teleport to these from another Roblox game.
This makes it so much simpler to manage games that have a hub and then bring you to another separate server for a quest or mission. It’s not only a lot easier now, but it’s a lot more secure since Roblox handles more of it for you. This feature is going to be extremely useful for a lot of people.
The only real data that’s safe between servers is data in the same game saved through datastores (Ephemeral DataStores pleeeease). I would love for Server -> Server data for teleports instead of Client - > Server to make it all a lot more simple but until then I just don’t see the point in having any code that has data passed around like this.
To clarify I appreciate this addition, I just don’t see the utility in it’s implementation.
