ive looked on YouTube and dev forum for an answer for this but I can’t find anything
im trying to make a gun system, it uses ray casts on the client and sends a remote event to the server with the raycast info; what validation checks can I run on the server to make sure the shot was legit?
I’d like to prevent exploiters from shooting through walls etc
im trying to run a raycast on the server from the player to the hit part but there seems to be lag or another part of the player is hit and the shot gets cancelled. I might try blacklisting every part of the character other than the hit part.
Distance checks and checking player (variables and some-things of your game), i think you should able to (client sends) and (server gets) information of the raycast RaycastResult (and check the raycast origin data in modulescript)
It’s actually bit of check (or alot of checks depends on systen) and also distance of the hits (Instances) through for loop and using Vector3 and the most problem is where Raycast started althought,
you could do like Raycast be in player’s character position, so that you can vaildate it
No using a FilteringEnabled server. This will prevent exploits, as it uses server-side verification to ensure that only valid actions can be performed (and therefore prevent things like aimbotting and wall hacks).
Because of network delay. What the client sees isn’t quite what the server gets.
It takes a while for the server to receive that a player has inputted a shoot command, so naively checking for positions on input received won’t cut it.
Rollback your server to when the player first sent out a shoot command (using timestamps), and then do your raycast checks.
For security sake, no. Raycast information can be spoofed by a client prior to it being sent to the server.
Same reason why this:
isn’t enough.
FE merely prevents a client from directly propagating their own changes to other clients.
If the data they sent was faked (and the server won’t sanity check anything), the server will replicate that data anyways, and it won’t know any better.
Is rollback a feature integrated into roblox? - if its not, would i have to create a moduleScript and save every player’s position every .25 seconds or something ; and only keep 5 seconds recorded at a time to prevent lag; would this method be resource heavy on the server, especially with alot of players?
also, i worded it badly before with the raycast info - it creates a new raycast on the server to check if the client’s raycastresult was legit.
that actually isnt entirely true, yes a client can intercept and spoof data using a tool like roblox++ or roblox lua c or another tool, but you can prevent it using the new RemoteEvent security system. Also, RemoteEvents, are also not client authoritative unlike RemoteFunctions, which can be spoofed to the server. So for the most part, so just use RemoteEvents the proepr way