You have to split your logic up into “Proxy Events”.
Client (Autonomous) presses fire, checks if it can shoot (ammo, other), Fires a local shot.
Local shot handles all the local hit fx.
RPC the Server (Authority) to shoot.
Checks if it can shoot (ammo, other), Fires a local shot.
Multicast for sims (Simulated) to shoot.
MC executes logic on Sim proxies only.
Get Local Role == Simulated Proxy -> Branch [true]: Event Sim Shoot
Event Sim Shoot (data): uses the same values the server used to shoot, so it get the same trajectory on shot.
Clients can pass simple vectors to the server to validate shot.
For Hitscan you’d pass the trace start/end vectors. Server can then compare the start and end points against its own calculations. If distance for each is within margin (few cm radius) use the clients values, otherwise use the servers.
This is solid for single fire. For Burst and Auto firing you only validate the first bullet, then the servers calcs are used for all others.
e.g. Burst firing typically does 3 shots in a loop. Client would pass the first shots values.
Server would scrutinize the first shot, make decision on which values to use, then fire the next two with no regard to what the client did.
Same applies to automatic firing. First shot checked, remaining are not. Server uses its values for all proceeding shots.
For projectiles you pass muzzle location and the final Velocity vector. Compare these.
We only compare the first because they are the only ones that are “truly” aimed. You want that shot to hit where the client was aiming. The remaining shots are chaotic recoil applied mess.