Should a combat system be in local or server scripts (solved)

So I’m making a melee combat system for my game. I’m going to modify the one in this tutorial (linked below). In the tutorial he puts everything in a local script, meaning other players won’t be able to see anything. But then he does some data thing, throws in variables, and fires it to the server. I’m not too sure what that’s all about.

Would it be better to do a combat system like this in a server script so everyone can see it? Or would it be better to do it in a local script for some reason? If so how do I make it so other players can see what’s happening?

Roblox Sword Combat Tutorial Part 1 - YouTube

1 Like

Sending things to the server is normally a bad idea in things like PVP, for example if your client is going to send damage values to the server that’s really bad, since it could be used by exploiters to kill anyone they want. You should make sword collision detection and damage serverside, but animations and operating the sword itself clientside.

2 Likes

Usually you would want to do the opposite, have damage and all calculated on clientside and sent to server with the animations being played server side. At least that’s what I’ve done and been told by multiple people, since calculating collisions can be super resource intensive and will slow down everyone in the game if put on the server

If you’re sending damage values from client to server, an exploiter could send over 9000 damage to the server to everyone, which is a big flaw.

2 Likes

You have been given very bad information!

Animations should very rarely be played on the server. Since animations contain many moving parts replicating that to each client consumes tons of bandwidth, lagging your game especially for mobile players Animations work fine on the server! I was incorrect!

Trusting clients with collision detection means hackers very easily exploit your game. They can simply tell the server they’ve killed everyone and ruin the game. It’s fine to show collision effects on the client as long as you verify it’s a valid hit on the server. Collision can be very simple on the server, for some reason using tons of raycasts is popular but it’s slower than just using box-based collisions, still raycasts aren’t terribly difficult for the server to do.

3 Likes

Does Roblox actually do that though? It would make sense if they just replicated the animation itself and had all of the clients play it behind the scenes. That’s how these systems are handled.

1 Like

Everything to do with collisions, dealing damage and that should be done on the server. Exploiters can only do stuff on the client, so if we have this being done on the client, it would be catastrophic.

Everything to do with animations and visuals should be done on the client. If you want to replicate something to all clients, I reccommend creating a Remote Event and using :FireAllClients() to replicate it to all clients.

Hope this helped!

2 Likes

Just looked over my scripts and realized I had that backwards. My damage and collision detection is done on the server but animations are also played on the server. I don’t see how playing animations gives much of a load to the server, also depending on the game it is necessary to play the animations on the server so all clients can see it, aka fps and other fighting games

2 Likes

Very glad you do not have to flip your systems :slight_smile:

Yes it would seem animations played on the server do replicate much smoother than I said, I must’ve messed up my animations previously! I assumed they were working like tweening parts on the server, which is certainly very bad for bandwidth.

2 Likes

Just add a limit? Not that difficult to verify data.

You should have both, but keep a lot of the checking in server scripts.

If I do a move, let’s say M1 or something basic like an ‘E’ spell/move, it should first locally check if I have a cooldown, and if the cooldown is inactive then it fires a remote event, which when the server gets it, it checks that the player is able to firstly, do that move, and secondly, is not on a cooldown.

Keeping player input on the server is generally bad practice and I suggest calculating most of the other aspects like damage, cooldown, knockback, etc, all on the server since it will be more universally ‘true’ than the client.

You’ll need to add too many limits and checks:

  1. Is the sword touching the player?
  2. Is the value low enough to be real?
  3. Has damage been applied to other players or this player recently?

OR you can do everything in a server script and not having to do all these checks for exploiters.

1 Like

Yup! The more you have, the more secure your game is!

Jesus Christ this definitely became my most replied post overnight

1 Like

I have one question. How would I play certain sounds? I want swing and hit sounds to be heard by everyone in the server. But since animations are client sided how could I possibly sync up sounds with the swinging animations? I also want my kill sound (only heard by the killer) to be local, clashing sound to be heard by everyone in the server, and level up sound to be local.

There’s this post that explains I can pretty much insert the sound into the animations themselves, which means syncing isn’t an issue for swings, but since animations are being played locally it means no one will hear them. Can I play animations on the server? Or for a better question can I use the tutorial video linked in the post and just convert it to server instead of client? Because pretty much how he makes it work so everyone can see stuff despite it being client is sending a data dictionary to the server. I feel like this could not only cause lag but be a nightmare for laggy mobile players. So in the end would it just be better to do the combat system on a server script?

Wait nevermind server sided just seems better overall in general

Yeah controls will be client sided. I’m gonna use context action service for the whole system. When a weapon is equipped it fires a remote event that binds the unsheath button. Then when a player clicks unsheath it fires a remote event to unbind unsheath then bind sheath to the same exact key/button and also binds all the combat action functions. So when those keys/buttons are pressed it’ll run the combat function for that (for example slashing).

That would mean no one else in the server would be able to see the animations… I don’t think that’s how it’s supposed to work.

It is possible by firing the data to the server but it’s just inefficient and bad for lag. Server sided just seems better for everything

1 Like

Genuine fear from hearing that before realizing you accidently mixed up your words. :joy:

Client side hitbox + effects with server sided verification (Performant, fast, but can lead to some false positives or super weird hits/slightly advantageous exploited hits)

Client side hitbox + effects + vertication (Very bad, don’t do verification on client and trust it immediately)

Client side hitbox with server sided effects and verification (Laggy due to effects being on server)

Server sided hitbox and verification with client sided effects (Most “accurate” in terms of verifying which player should do what, issue is that ping becomes a major part in breaking this system and input lag is very pronouced)

Client sided hitbox with verification and effects and server sided verification (Have clients check the attack and verify with eachother if accurate, then check on server to be dubiously sure)

TL:DR
Client side: For effects for sure
Server side: For verification
Hitbox: Both for fast registration as well as verification from server standpoint, requires a little client prediction and math to get it working but should be mostly fine… I think

1 Like