Is it safe to return info from the server to a local script using a module?

Help and Feedback Scripting Support
#1

Is it safe to take information from server services (for example, values from server storage) using a module script that will return the table to a local script?
This is part of code from module script in Replicated Storage

local DataFolder = game:GetService("ServerStorage").PlayersData
function module.GetOptions(plr)
	local options = {}
	for i,v in pairs(DataFolder:FindFirstChild(plr).Options:GetChildren()) do
		local a = {[v.Name] = v.Value}
		table.insert(options,a)
	end
	return options
end
#2

And

The local script will not be able to access server storage. Unless the information is passed through remote events.

Try it out.

#3

That would be unsafe to transfer data through a remote event because hackers can change that data and or view it.

#4

No it would not be unsafe in this scenario, this is because the data needs to be transferred to a local script which a local script will need and not kept a secret on the server implied by this quote.

In this case it’s PlayerOption data. If an exploiter changes it and views it it would only be for the exploiter and not anyone else due to filtering enabled. Unless you also intentionally bypass it with another remote event which introduces a vulnerability.

I mean how else are you going to transfer information to the client in a way hackers cannot tamper with it?

#5

Mb I thought it was the other way around, anyways thanks for correcting me.

1 Like
#6

This is part of code from module script in Replicated Storage

You’re replicating this modulescript to the client if it’s held in ReplicatedStorage, so whatever info is held in it is not hidden from players. You could hide it by putting this modulescript in ServerScriptService and have another (also in ServerScriptService to hide it as well) server-sided script handle remote event communication with the client. Say, client fires an event asking for info, the script that require()'s the modulescript grabs it from module, then fires it back to the client. The middleman script won’t expose any data the player shouldn’t see.

1 Like
#7

I felt that I did something stupid, because I did not even check how work of these scripts.
In any case, thanks for clarifying my problem.

1 Like