|
Server-side validation: a few mistakes that let clients cheat (and how to fix them)
The client is an untrusted input device
Most "hacks" on a game server aren't magic — they're the client being trusted with something only the server should decide. If you run a server, these are the mistakes I see most often, and how to close them. Nothing here is exotic; it's just discipline about where the truth lives.
1. Trusting values the client sends.
Position, damage, gold, cooldowns — if the client reports them and the server stores them as-is, a modified client just reports whatever it wants. Fix: the server owns state. Recompute or validate server-side (did the hit land given server-side positions? did enough time pass for this skill?). The client sends intent ("I want to attack X"), never results.
2. No bounds or rate limits.
Even if you validate a value, check its range and its frequency. A client that sends 500 pick-up packets a second, or a trade of -1 items, is abusing a missing check. Fix: clamp every incoming value to a sane range, and rate-limit actions per connection.
3. Replayable packets.
If the same packet works twice, you get dupes. A captured "move item" or "confirm trade" packet replayed at the right moment is a classic economy break. Fix: sequence numbers / per-session nonces, and make state transitions idempotent — a trade that already completed can't complete again.
4. Authorization decided on the client.
"Can this player open this window / use this command / enter this map?" If the client decides and the server obeys, that's not a check. Fix: every privileged action re-checks permission server-side, every time.
5. Trusting client-supplied IDs and prices.
If the shop sends the price, or the client tells the server which item id it bought, a modified client buys a top-tier item for 1 gold. Fix: the server looks up price and item from its own catalog by id; the client's copy is display only.
The one rule
If a value matters, the server must own it or re-derive it. Treat every byte from the client as hostile input and most "hacks" simply stop working.
Happy to go deeper on any of these if it's useful.
|
