I was looking into FPS Shooter template in Roblox Studio and there are a lot of great code here. But there is a really questionable decision: all weapon stats are taken from attributes of a model that was sent through remote event. Is it really reliable?
I think so, but it is not easy nor fun to manage.
I recommend changing it to work off of modules instead.
i’m okey with this because i am not doing a shooter and guns are really small part of a game, but why it is reliable? i don’t get why i can’t send some false stuff through remote and set some crazy attributes to it
Roblox’s gun kit doesn’t have that.
The server reads the attributes not the client.
All the client sends is the mouse pos, even then the server still double checks if they are allowed to shoot and verify if it is a fair shot.
If there are no checks on the server anywhere it is NOT reliable, never trust the client
I understand, but what’s the problem of passing item with fake attribute values?
I’m sorry but I don’t understand. Your issue is players passing through fake items?
Yea. I was thinking: why player can’t pass an item and make some random attributes for it and deceive server this way?
The client does NOT put the item through the event. When the event is fired, the server goes and checks the gun the player is using. The client CANNOT change the values, as the server will only see the server values.
Holy. even if the client changes the values, the server will only see the server values.
Do you even know how client and servers work?
Yes, I believe I have enough knowledge in order to speak about topic.
Of course, if client sends same weapon, server still will see values that he have set. But why we can’t imagine situation when we create imaginary tool from the sky, give him same properties but change attributes to other numbers?
The server won’t see the tool, as the tool is only on the client and will simply just ignore the fired event.
Okey, then it seems like I don’t exactly understand how instance sending works under the hood. In my picture it was sending like a table with fields and so on. So server will think that it is a real instance. Do I understand it right: server gives some unique ids to all instances and under the hood when I send instance from client, I in fact just send this unique id and then server just takes this id and find instance under this id so it’s not possible to give him invalid instance (meaning instance that I have created on client) in fact?
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.
