I recently decided to try parenting my remotes to nil on the client to make it more difficult for exploiters to obtain them however in doing so I noticed the server can no longer read the Player argument.
If this isn’t a bug and actually somehow a feature I’m interested in knowing why.
This also applies to remote functions,
I would not think this is a feature as if you dont know who is sending the request then its quite pointless to recieve the request
This is certainly a problem, however, parenting them to nil on the client shouldn’t be something you ever need to do since your RemoteEvents / RemoteFunctions should be secure anyway. Definitely don’t put anything that would allow people to mess with your game negatively in RemoteEvents / RemoteFunctions (i.e. loadstrings or something like that) as it will end very badly.
As far as I know, the client is responsible for sending the player object to the server (don’t worry, it gets verified by the server so cheaters can’t fire remotes as other players). In Roblox’s engine, there doesn’t seem to be an easily accessible global reference to DataModel, so many functions retrieve it by climbing the hierarchy of an instance (object.Parent.Parent… etc until game is reached). In the case of FireServer and related methods, the remote is used to find DataModel before locating the Players service and LocalPlayer. If the remote’s parent is nil, it can’t find DataModel and will end up sending nil to the server.
Unfortunately, even if this did work, most popular Roblox cheats are able to see and interact with nil instances anyway.
I am fully aware that some exploits are able to read nil objects. This is a solution to the exploits that can’t read nil objects. I have sanity checks in place and systems to kick the player in the event they disable a script of mine.
