Should client-side CanTouch values affect `.Touched` callbacks firing on the server?

Help and Feedback Scripting Support
#1

When a client disables CanTouch on a part locally, it seems to cause any server-side .Touched callbacks to not fire for that client. Is this expected behavior?

The setup: I have an anchored box part. I have set a callback for the .Touched event with a Script running on the server. When I disable the box’s CanTouch property with a LocalScript on a client, the .Touched callback does not run on the server for that client. However, it does run normally for the other clients.

The problem: I would expect that .Touched events would fire on the server based on the server’s value of CanTouch and not on the client’s value of CanTouch. This may be exploitable if certain game mechanics rely on volume collision detection through .Touched (such as monster aggro). People running exploits could disable CanTouch and not trigger those events.

My question: Is the right answer not to depend on .Touched for parts of the game which should be resistant to exploits, or is there another way to avoid this issue?

You can see a video of a baseplate repro of this here:

Here is the baseplate file for the repro:
cantouch_baseplate_repro.rbxl (49.5 KB)

#2

You are right, if the client disable CanTouch of a part (clientSide), the event is not listened in Server Side either…

I think thats the right answer. Do not rely on touched events for important things in the game, like a part that kills the player.
If exploiters choose to disable touch events, they wont get advantage, they would get something like not being able to open a door to continue with the game or not being able to open a shop GUI.
(could use loops to constantly enable CanTouch from server tho… but, sounds like a horrible patch…)