Trigger Origin [Remote Event]

Feature Requests Engine Features
1

Hi! We are currently experiencing difficulties with exploiters, we all know the origin of cheats which mainly comes from RemoteEvents

I’ve thought about it vaguely, but it might be useful to receive the origin of the trigger directly on the server, without going through the client.

What would it look like?
When triggering :FireServer() , For those who wish, we could access it via the event Connect(function(plr, TriggerOrigin)) a TriggerOrigin variable, to avoid blocking old scripts that are already connected to events, We could opt to include a Trigger enumeration. Like : Event.TriggerOrigin

What would this be used for?
Allowing creators to access a trigger origin could help combat RemoteEvent execution by exploiters

We could check if the origin exists on the Server.

__

What are the disadvantages?

  • Scripts cloned via the client would not be recognized as “eligible” for execution.
  • Scripts created via the client would also not be “eligible” for execution.
  • Roblox will need to create an enumeration, or a fetch event to receive the origin on the server without going through the client, since the client could point to another script already existing on Server.

__

Let me know what you think!

  • Good idea, this could be useful to me.
  • I don’t think it will be useful to me, but it’s a good idea.
  • Bad idea
0 voters
2 Likes
2

This unfortunately ultimately solves nothing, as exploits would evolve to allow spoofing which script a remote call came from, eliminating all of the upsides. There’s also all of the downsides you list.

12 Likes
3

while not perfect,
A great way to combat client exploits is to treat every event from the client as nothing more than a request, the client shouldn’t ever be able to tell the server to do something, only request so. The server should be responsible for checking weather or not the request is valid or not.

4 Likes
4

As mentioned before, you’re asking the client for the origin here, which doesn’t solve anything.
If you’re thinking the first argument can’t be spoofed, that’s because the server adds it automatically based on who sent the request

You can implement client-side origin checks yourself
It does add a layer of security, but only against casual exploiters
Determined exploiters can modify their scripts to bypass it, so don’t rely on it for authoritative validation

1 Like