On all my previous games, i’ve done hitbox detection on the server out of reflex, cause of exploiters etc. But recently i’ve been considering doing it on the client because it’s way more fluid there. I am thinking I could do that if I am able to support it with some server-sided sanity checks but I am not sure.
Ideally you do both. Detect it on the client, and if it hits, send it to the server to validate whether or not it should’ve hit.
On the client, you can make some kind of instant feedback so it feels responsive while the server calculates everything and actually deals the damage.
For example, you could play particle effects or animations on the client whenever you hit an enemy so that it doesn’t feel clunky waiting for the server to tell the client to make those effects. This way you can keep the gameplay feeling smooth while having maximum security.
There are other posts about this on the forums, which I’m sure you can find with some searching - definitely some very helpful stuff. I don’t have anything at hand, but it shouldn’t be hard to find.