Is it possible for a client to fake its player controller in an RPC?

Development Programming & Scripting Multiplayer & Networking
, ,
1

I’m trying to validate a custom event RPC from a client by passing its player controller through an input. I initially thought this was bad practice because the client could cheat by sending someone else’s player controller as the input. Then I realized the client always considers itself to be player controller 0, but the server still interprets the input as being from player controller 1. This means that seemingly, the client is already sending false info and the server is correcting it.

So, my question is this: Is it possible for a player to cheat by faking this input, or is the server always capable of identifying the correct player controller input from custom event RPCs?

Also, I know the server accepts RPCs based on player ownership, but for my game I can’t rely on that alone for the functionality I’m going for.

2

Clients don’t have a copy of other players controllers. So any reference you get isn’t technically valid in that regard.

Clients cannot fake an RPC from another client. For example player 1 can’t send an RPC to the server acting like its Player 2 regardless of the data you pass along.

In multiplayer you shouldn’t be using Get Player Controller (index), that’s for single player. For multiplayer you use Get Controller called from the Pawn class, then cast to your controller class if you need access to custom vars/functions/events.

1 Like