Keeping your Game Secure
Hmm what does that mean? Keeping your Game Secure (KGS) means protecting your remote calls, proximity prompts, preventing backdoors, etc. This guide/tutorial will teach you the basics of server-side protection for your remote events.
Preface
You have probably heard the saying from experienced developers, “never trust the client”. The reason why you never trust the client is because exploiters and cheaters can modify and manipulate what the client can see or have. This is why server-sided checks are so important, you can make sure the client isn’t manipulating things.
Protecting Remotes
Remote Events are the most commonly exploited, and most easily exploitable. The client can fire any of these events, because Remote Events were designed for client → server and vice-versa. How do we protect our remotes? It’s pretty easy actually, and I’ll start with the most common example of this.
Preventative Action
Store System
A user clicks a button to purchase an item, now if you did the checks if they have enough money on the client, the user could easily just make it seem like they have more money than they really do and just purchase any items they want. This is why we have to check on the SERVER if they have the money.
Take this example of using the server to check:
Some code may be arbitrary, but this is just an example
-- Client
local btnPurchaseItem: TextButton = some.path.to.button
local reEvent: RemoteEvent = some.path.to.event
btnPurchaseItem.MouseButton1Click:Connect(function()
reEvent:FireServer(item.Name)
end)
Now we do not want to pass the cost of the item through the event, because again the client can manipulate the cost rather than manipulate their money. The exploiter likely wouldn’t change the name of the item because it wouldn’t do anything for them.
So we check on the server what the cost of the item would be then check if they have enough money for it.
Example:
-- Server
local reEvent: RemoteEvent = some.path.to.event
local itemPrices: {...any} = {...}
reEvent.OnServerEvent:Connect(function(player: Player, itemName: string)
local itemCost: number = itemPrices[itemName]
local playerMoney = -- Code to get the player's money
if playerMoney >= itemCost then
-- Code to purchase // Give the item
else
-- Do nothing here, or tell the player they don't have the money.
end
end)
As you can see in this example we are making sure the player has the money and making sure we grab the amount of money the player has on the SERVER, and NOT on the CLIENT. This way we can make sure the client doesn’t modify anything in order to purchase just anything they want without working for it like everyone else playing. Although this won’t detect cheaters, it will discourage and prevent them from cheating the store.
I will be writing more guides on different ways to keep your server secure so keep an eye out. This is just my first one and I want to see how it’s recieved before I spend more time writing out another one. I understand that this is a short tutorial.
EDIT: Apparently there’s a lot of people complaining about this post which sucks. However this several part tutorial is for newer developers who are just getting into scripting. This is not for the advanced people who already know all of this. Do keep in mind that if this goes over what you already know then it’s not for you, either post something positive, add to the discussion or don’t comment at all. It’s getting a little tiring seeing all the negativity on posts like these just because you guys assume that no one else needs these guides. Who cares if there’s a thousand other guides? My guides are going to go more and more in-depth as we go on.
tldr; don’t comment unless you’re going to be positive in some way. being consistently negative hurts the community and makes you look dumb.
