- Worked on the Menu UI and a demo of the upcoming shop/plane customizations system.
- Rockets!
- “Return to combat zone system,” before it was just an invisible wall that people crashed into
- made a dev panel and suggestion system
- speed/throttle control
(my video recorder sucks so the ingame FPS is actually much higher )
click this to see how rockets are secured, I made the system myself and im excited to see if there are any loopholes. If so, please tell me
rocket security:
for the rocket system I’m using projectiles created on every client + client sided hit detection. This means that:
- there is no projectile on the server, making it impossible to secure via normal raycasting/touched events
- exploiters can simply teleport their rockets to enemy players, or even just skip the whole projectile system and just fire a remote with location data.
So how could I secure it? Heres how the final system works:
[PREREQUISITES]
- all rockets travel at the same speed, 100 studs per second. This is important.
- all rockets explode on impact (no heatseeking, bias for anchored or unanchored parts, enemy aircraft, etc.)
[TIMELINE]
-
client creates a projectile, then sends start position of rocket to the server, as well as the command “Start”
-
server receives data, checks if the start position is close enough to the player’s aircraft. Then, server stores a table into a database consisting of {StartPosition = starting position, Time = tick(), Player = player, ID = id} the ID is the order in which the rocket is fired (if rocket is the fifth rocket out of 10, then id will be 5).
-
server tells other clients to render projectile (visual purposes only)
-
client handles hit detection, and once something is hit it sends the rockets position, the rockets ID, and a command of “Finish” to the server.
-
Server receives data, then does the following calculations.
- creates a tick() variable called finishtime
- creates a endposition variable from the position send by the client
- looks up the rocket data in the database, creates a variable called “rocketdata”
- calculates the time it would take going 100 SPS from rocketdata.StartPosition to the given end position, then compares that time with the actual elapsed time from rocketdata.Time to finishtime (tick())
- casts ray from rocketdata.StartPosition to the endposition variable to check it the rocket’s path was legit (ignores all moving aircraft to make sure nothing is obscuring the path)
so overall, even though the server can’t see an actual projectile, it uses minimal data from the client + real data from server to secure
- elapsed time, so that exploiters can’t instantly fire a rocket and make it hit people (they gotta wait the actual time)
- position/rocket path, so that exploiters can’t simply teleport their rockets to enemy gamers. (there must be an actual path from start to finish)
- ammo amount, server keeps an ammo count to make sure exploiters arent firing more rockets than they are allowed.
so, to spoof a request, an exploiter would have to:
- teleport their aircraft so that they are facing the enemy gamer, and are correct distance away
- send fake rocket data to server and actually wait 3 or so seconds until rocket would reach the target, THEN send the finish data to create an explosion.
- By this time, the enemy gamer has flown away and the rocket has hit nothing. The spoofed request didnt really give them an advantage over firing a rocket the legitemate way!