Hello, I was working on a remotes tracker which tracks some of the inputs from remote event and functions from the client side to log unusual inputs and was wondering if there’s a way to get which script instance the remote is being called from on the server side.
I don’t want to pass the script as a variable from the client side because I can’t trust their inputs. If it’s not possible to get the script from server side, is it possible for Roblox’s backend to track which script instance the remote is being called from? So that maybe that could be a new feature to track the calling script for validation.
As far as I know, you can’t check which script is calling a RemoteEvent. Why do you want to check where a remote is being called from? Your code should be secure enough for this to not be needed.
I agree our code should be top priority to securely process inputs.
But I also think it would be great to have a feature where the server knows where a remote is called from without the client telling the server. With that, we may perhaps be able to know that an injected script is calling our remotes.
The only way at the moment is what you stated, by passing a parameter that is the script, but obviously this is not the way to go.
Regardless, how can you tell what script is injected and what isn’t? Exploiters can just create a new script, inject code that fires the remote into the script, then name/parent it to look legitimate.
It’s not possible (as anything you have to get from the client has to be changed by them, so it can be changed) and it’s not a valid solution to exploiting. The best you can do is to never trust the client.
If a developer knows the name and parent of the script that calls a remote event, what can they do with it exactly? As stated by @PlayerHasJoinedand@i_ncendiarism, you don’t trust the client. The client can inject some script on their end change some stuff around and make it look like it was called from a script you have in your game.
If the player creates a script on the client, it wouldn’t be visible server side so if Roblox’s servers are able to track what is calling the remote, it may return a nil source indicating that it’s an unknown source.
And if it is possible to track where the source of the remote is being called from without using any information the client is telling the server.
I’d like to restate that I am asking for a way/feature to track remote calls using server-side information only if possible and not any information from a client.
Just thought you or anyone else viewing this thread should know that your efforts would’ve been in vain anyway, even if there was a way. Exploiters do not explicitly need a script instance to execute code, which means that if you were able to check what script called a remote to counter injected code calls, you’d get nil back or possibly even an error.
It’s about the same as dealing with a client-created instance not visible to the server, though in one case there’s an instance somewhere while in another there isn’t.