How can I prevent exploiters from firing events?

Help and Feedback Scripting Support
,
#1

The Issue

I have a system set up where when a player clicks a GUI button, it fires a RemoteEvent in ReplicatedStorage, and then a script in ServerScriptStorage detects when it is called. Once it is called, it will teleport a desired about of players to a new game. I have the teleport system and all that working, however I don’t know how to make it where exploiters can’t fire that event from their local script.

Possible Solutions

I thought of a few solutions that MIGHT work, however it is not a 100% guarantee.

#1. Rename the events to something strange such as “x13uF”. - The problem with this is that exploiters can still figure out what that event does.

#2. Use a debounce. - This could work however if the exploiter fires the event once when it isn’t supposed to be fired, it is still pretty crucial damage.

#3. Use tables such as this. - I think this could work however I didn’t really understamd much of what he was saying [as I am more of a builder].

If anyone can help that would be greatly appreciated. I am willing to work hard to fix this as it is a game-crucial event. Thank you!

2 Likes
#2

It is practically impossible to prevent an exploiter from firing events, because events are made for client - server communication or vise versa. What I recommend is ensuring that you never trust the client. By this I mean always do checks on the server, and never let the client perform actions via events. So lets say you had an event where a client wanted to buy something. If in the event the client sends the amount the item costs, they can simple edit that to 0 or something and will get said item for free.

Remember that a client can see anything on their computer, which means they can see all your events and their names if you allow them to (which is necessary for client to server communication).

1 Like
#3

Since you are waiting for a specific player to click a button, you can check whether the player which fired the RemoteEvent is an authorised player. If it isnt, just ignore the event.

1 Like
#4

You shouldn’t try preventing exploiters from firing the event in the first place, that is now how you do it. You should know that exploiters are clients too. What you should be doing is NOT trusting the client and validating remote requests. If exploiters firing your remotes is causing a huge issue, I’m sorry but there is a problem with your remote communication that needs to be addressed. Renaming remotes is security through obscurity - which is the worst way to go about this.

1 Like
#5

You can’t prevent exploiters from Firing Server events. However there are measures that you can take so this isn’t bad when it comes to your game.

  • Try adding obfuscated arguments in your RemoteEvent so it’s slightly more secure.
  • I suggest you handle everything that’s important to do with the server with just serverscripts instead of remote events if possible
  • Lastly, add checks in your scripts so it kicks exploiters if arguments are wrong, etc, etc.
1 Like
#6

This is just wrong. Exploiters can see arguments passed around so this is useless.

Potentially kicking players for an argument mismatch due to an oversight is horrible UX.

#7

If I am wanting to fire an event when a player clicks a GUI, is there anyway you know of that for the most part prevents exploiters from firing it? Or is there a way to make it where the event isn’t fired from the client?

#8

What you could do for this is implement a magnitude check. Basically checking how far away the player is from said button or whatever.

Let me know if you’re talking about surface or screen guis too!

#9

edit: incapaz had a good point.

#10

Pretty sure this can be spoofed if the exploiter knows how to script.

edit: besides how do you check how far a UI object is from a player char…

#11

It is a ImageButton inside of a ScreenGui

#12

I mean checking the distance server sided. If your worried about a player teleporting to said object, you could include a anti-exploit script for said teleportation. I’m pretty sure it’s impossible for players to change the way the server perceives their location (feel free to correct me if I’m wrong tho :slight_smile: ).

#14

Do you know a way to do this? I have been searching for this for a long time!

edit: How do I tell who fired the event? Is that possible?

#15

Uhhhhh the player argument?

remote.OnServerEvent:Connect(function(player) <--

end)
#16

Looking at it, I’m not entirely sure why you need to prevent exploiters from firing the event. Could you give a bit more insight onto what it specifically does (the event)? Like do you need a certain amount of x to teleport to said place?

#17

Ohh right! So would this code make sense?

 remote.OnServerEvent:Connect(function(player)
if game.Players:FindFirstChild(player) then
--code here
end
end)
#18 
RemoteEvent.OnServerEvent:Connect(function(player)
end)

The player argument is default and is the first argument passed to the handler function.

#19

No, because the player will 100% exist in game.Players, otherwise they wouldn’t have been able to fire the event… unless they fired it and left straight away.

#20

Basically I am making a story game with a “VIP” ‘car’ feature. If the player buys a VIP car, then they can decide who is let into it. They can also decide when they want the game to start. I have the rest setup except the start function.

#21

I’d suggest just going with what incapaxx said and simply validating checks, kicking players for abnormal arguments is not recommended if you care about UX