Secure Client Side Hit Detection

I am currently working on a game with multiple objects such as plane tanks and boats. I am tried doing hit detection on the server which gets fired by the client. The client only gives the magnitude, direction, and weapon. It seems to be very unreliable in a high lag environment. I decided to switch over to client side hit detection but don’t really get the framework on how to do it with high security. How would I go about doing hit detection with a lot of objects and players?

3 Likes

Client .Touched connection is more reliable in my experience. However, using remote events to sent touch data to the server, has the trade-off of a huge security risk, as you mentioned. A player could fire the remote event, with whatever parameters they wanted, and trigger touches that didn’t actually happen.

There are two main solutions to this.

  1. Perform server sanity checks to ensure that the touch is valid. This can be done by using a Region3, or a Ray, to detect if the desired object is actually in said area.

  2. The better option, in my opinion, is to just do hit detection on the server. If you don’t trust .Touched alone, you can use a Region3 to verify it. .Touched should be pretty reliable for the most part, though, even on the Server.

Also, the methods for hit detection shouldn’t change depending on the amount of objects you have in your game. You should still be able to use normal methods, as long as you don’t overuse Region3 checks, or Raycasts, you should be fine.

the sanity check using region3 might actually be the best method, I can still get the bullet origin and look vector as the client would still have to do that on their own, the region3 sanity check is actually a good idea I am going to try that, the solve might return a little late since it might take a while to program. only 3 things are done by the client, the direction and position.

1 Like

I secure my client hit detection by doing the following:

1)When the client’s ray hit an object I send over the StartPosition, TargetPosition and Hit and HitPoint of the Raycast.
2) I validate the start position by checking its distance in relation from where you expect the rays to originate.
3) I validate the HitPoint by checking if its between the start and the TargetPosition and checking its distance to the Hit.Position.
4) I cast a ray from the StartPosition to the HitPoint to ensure that nothing is blocking the shot.

Imo server side hit detection is not the best option since it will be absolutely horrible for players with any sort of latency, which is why most popular fps or projectile based games use client side hit detection on roblox, because even if you use server-side hit detection this still will not make it 100% secure from spoofing the mouse position, and you’re just making a bad experience for all normal players with a bad/normal internet connection. A tip that I read somewhere that is very useful is to remember that you’re designing your game for actual players not for exploiters, and using server-side hit detection will make a bad experience for most actual players without some sort of lag-compensation system, which is still not feasible on roblox since you will still have to get the ping from the client.

19 Likes

Just realized one thing, how do you handle ammo consumption and firerate?

For firerate you could use a leaky bucket (Leaky bucket rate limiter) and for ammo consumption I’m still in the processing of finding the best way to do this for a game I’ working on, it will be done on the client, so I fire a remote event when the reloading event began and when it ended, and check the time difference and add a cushion to account for lag, this is not the best system because It can still result in fail cases in the case of extreme latency but I’m still figuring out a way to fix that, because I don’t want to handle reloading on the server.

sorry for reviving this old thread but how would you take account for bullet drop? because the bullet could drop behind a wall and the server would cancel the hit.

1 Like

Hello. Just a question . do you have a hit detection method for projectile base hit detection? Thanks for posting that post . It help me make a cool sword with good hit detection !