How to communicate to the server the new state of the player in a secure way

Help and Feedback Scripting Support
#1

Hello i have an ability wich is fully handled in the client and i want to communicate to the server that the player has started attacking using a remote event but a hacker can just remove that line of code and the server won’t notice.

The script below is the ability stored in a module script :

-- Player related variables
local player = game.Players.LocalPlayer
local character = player.Character or player.CharacterAdded:Wait()
local humanoid: Humanoid = character:WaitForChild("Humanoid")
local humanoidRootPart: Part = character:WaitForChild("HumanoidRootPart")

-- Overlap params
local overlapParams = OverlapParams.new()
overlapParams.FilterDescendantsInstances = {character}
overlapParams.FilterType = Enum.RaycastFilterType.Exclude

-- Services
local ReplicatedStorage = game:GetService("ReplicatedStorage")
local RunService = game:GetService("RunService")
local Debris = game:GetService("Debris")

-- Events
local destructiveRushEvent = ReplicatedStorage.Events.WeaponEvents.Katana.DestructiveRush

-- Module 
local hitboxModule = require(ReplicatedStorage.Modules.Hitbox)
local canAttackModule = require(ReplicatedStorage.Modules.CanAttack)

return function()
	if not canAttackModule(character) then return end
	
	--Tell the server that the player has started attacking and check on the server if they can attack
	
	local linearVelocity = Instance.new("LinearVelocity")
	linearVelocity.Parent = humanoidRootPart
	linearVelocity.Attachment0 = humanoidRootPart:WaitForChild("RootAttachment")
	linearVelocity.RelativeTo = Enum.ActuatorRelativeTo.World
	linearVelocity.MaxForce = math.huge
	linearVelocity.VelocityConstraintMode = Enum.VelocityConstraintMode.Plane
	linearVelocity.PrimaryTangentAxis = Vector3.xAxis 
	linearVelocity.SecondaryTangentAxis = Vector3.zAxis
	
	--Create Hitbx
	local attachedHitbox = hitboxModule.new("Attached")
	attachedHitbox.CFrame = humanoidRootPart.CFrame * CFrame.new(0,0,-2)
	attachedHitbox.OverlapParams = overlapParams
	attachedHitbox.Size = Vector3.new(5.5,5.5,3.5)
	attachedHitbox.Debug = true
	attachedHitbox.Character = character
	attachedHitbox.Duration = 10
	
	--Starts hitbox
	attachedHitbox:CreateAttachedHitbox()
	
	local connection
	connection = RunService.Heartbeat:Connect(function(deltaTime)
		local targertsHit = attachedHitbox:Update()
		
		local humanoidRootPartLookVectorXZ = humanoidRootPart.CFrame.LookVector
		
		linearVelocity.PlaneVelocity = Vector2.new(humanoidRootPart.CFrame.LookVector.X,humanoidRootPart.CFrame.LookVector.Z) * 50
		
		if #targertsHit > 0 then
			destructiveRushEvent:FireServer(targertsHit)
			
			attachedHitbox:Destroy()
			linearVelocity:Destroy()
			
			connection:Disconnect()
		end
	end)
	
	Debris:AddItem(linearVelocity,10)
end
#2

But everything you’re doing in the client won’t replicate to the other clients, so pretty much the ability will only work for the player using it. I think you should use a RemoteEvent to activate the ability, and let the server handle what happens. That would consequently solve your problem, since if a hacker were to delete the line which fires the event, the ability wouldn’t work.

#3

This solution would work in a perfect world, but the reason i’m handeling everything on the client it’s because it’s smoother and less laggy for all players. My script only creates the hitbox and moves the player in the direction that they are moving at, and since position is replecated automatically i don’t have to worry about other players not seeing the ability. The only case where i would need other players to see the ability is for the VFX but i haven’t made the VFX yet so i don’t need it.