Guests still exist

Maelstronomer · January 20, 2018, 8:24pm

Guests still exist

open up 2 windows on any game
on the 1st window, log out, then on 2nd window, click play as fast as you can

They’re also still on android

ColdSmoke · January 20, 2018, 8:55pm

Oh boy I wonder how many security issues this leaves open

I know at one point for some half-finished game I gave negative UserId’s admin power so I could test stuff in studio. Yikes

Maelstronomer · January 20, 2018, 11:04pm

Here’s a video repro (timestamped to 5:17)

Dev_Ryan · January 21, 2018, 12:44am

I always do things like checking if the UserId is greater than 0 before saving data and definitely before giving admin commands.

TheNexusAvenger · February 20, 2018, 2:12pm

Going to bump this as someone pointed out a batch script that can let you join any game with any guess id. You can just create a shortcut of Roblox with this:

%localappdata%\Roblox\Versions\version-9e01866eaf04431b\RobloxPlayerBeta.exe --play -j https://assetgame.roblox.com/game/PlaceLauncher.ashx?request=RequestGame&placeId=1416690850&userId=-1 -a https://www.roblox.com/Login/Negotiate.ashx -t Guest%3A-1337

In a nutshell:

Looks for game exe
Attempts to play and join with the game id (currently set to a small test place)
Gives the authentication url to join as userid=-1
Gets authentication url for Guest

UnderMyWheel · March 15, 2018, 2:22am

Unsure if this specific exploit has been patched, but I didn’t want to create another report. As of now, guests still are joining games and it seems to be breaking some games since most games no longer offer guest support since guests were supposed to have been removed months ago.

This exploit needs to be fixed urgently before it continues to spread and do more damage.

Seranok · March 15, 2018, 4:13pm

This is not a bug - it is still possible for players on some old clients to join games as guests. I would advise leaving around code which handles guests until that original thread is updated to say that guests have been entirely removed.

unix_system · May 8, 2018, 1:51pm

Will we get moderated, as previously occurred, if we ban guests?
There seems to be a way to exploit certain admin command scripts by use of a Guest account.

shayner32 · May 13, 2018, 1:17pm

I know for a fact Phantom Forces does it.

I can imagine that there’s a lot of stuff that relies on there being guests in the internals of ROBLOX, so it wasn’t as easy to remove as they thought.

TheNexusAvenger · July 4, 2018, 12:12am

This is a reminder that new clients can still get guests to run with the current client. Here is a picture of me as Guest 1337 getting the winning kill in Brickbattle Blast.

TheRings0fSaturn · July 10, 2018, 9:37am

I feel like Roblox should bring back Guests, mainly so new players aren’t forced to make an account they might not come back to if they don’t find Roblox to be enjoyable.

I feel a solution that could work out for everyone, is to have it so you can play as a guest up to 90 days after first coming onto the website, after that time you’re forced to make an account, otherwise you can’t play on Roblox anymore.

Kampfkarren · July 10, 2018, 10:48am

That solution doesn’t help anybody. Developers hate guests because it means exploiters can join games faster, we have to write special edge cases for guests everywhere so that data saving isn’t wasted on them, they’re useless in terms of data analysis, etc.

TheNexusAvenger · July 17, 2018, 8:32pm

Looks like the back end for getting guest session cookies was either moved or removed. “https://www.roblox.com/Login/Negotiate.ashx” is now returning an error message, and I can’t enter games now with what I posted before.

UnderMyWheel · July 17, 2018, 9:16pm

Hopefully, guests have now been fully removed. Now we just need confirmation from a staff member.

Kampfkarren · August 12, 2018, 6:34am

They’re not, I’ve seen several still in games. It’s been 10 months.

Kiansjet · August 12, 2018, 6:36am

I don’t know how guests are given IDs. However, if it’s sequential, I logged in ~30m ago at ~11PM PST and my ID was Guest ~3000. If so, there’s a lot of work to do.

cosmonomical · August 16, 2018, 7:33pm

guests still exist for me and it doesn’t even require me to do any glitches, all I have to do is open safari and play a game.
i literally don’t even have to do anything else.

TheNexusAvenger · August 25, 2018, 4:56am

Does this still happen when you clear your cache for Roblox on Safari? Curious if the JavaScript is caching.

cosmonomical · August 25, 2018, 12:38pm

ill check in a couple of hours, I’m not exactly how to clear the cache though so could you tell me so I can figure out when I get back?

TheNexusAvenger · August 25, 2018, 3:17pm

I don’t use Safari, so this may or may not work.