Client side vs Server side shooting authority?

anonymous_user_843fbdb5
Fri, 09 Apr 2021 19:51:14 +0000
Multiplayer & Networking

Hi all,
I am making a multiplayer shooter game and have some questions. It will be really helpful if someone experienced can clear my doubts.

Note: I know hacking can not be completely prevented but all I mean here is minimizing the loop holes in the game. Also, all I want is better user experience.

While shooting I am spawning the bullet on client as well, so that it doesn’t seems to be laggy that the player will wait for the server to spawn the bullet. Now the bullet has some random spread, so the bullet hit location at client and server will be different since it is randomly calculated. I don’t want that the client hits the enemy but won’t kill him because of the different spread at the server which might not hit the enemy. So as to provide better client experience I am just calculating the hit location at the client and sending the bullet hit location to server so that server and client bullet hit the same point. But this is prone to hacking (easy aimbot if someone could change its client code). Is my approach right? Sacrificing hack proof code for better client experience? Or there is some other way to prevent hacking even by having same bullet hit location on both client and server?

Now the second thing, with above approach, I have to send a reliable RPC every time a bullet is spawned. This means that a reliable RPC will be sent every 0.04s-0.8s according to gun’s fire rate. Is this ok because I have read that reliable RPCs should not be sent on every tick. The above rate is close to that of tick (though it will only be sent when the player is firing). Can this cause reliable RPCs to overflow?? Or this is fine since though it is sending reliable RPC’s at a fast rate but it is not on every tick as the player will not be firing all the time. Is this right? Can it cause problems?

Now if I go with sending hit location to server which is prone to hacking but provides better user experience. Then shall I go with client-side hit detection(applying damage on client and sending to server) instead of server-side hit detection(applying damage on server and replicating)? I am saying this because since it is already prone to hacking if I am sending hit location to server, so why not just add client - side hit detection too for more better user experience and also if I do this, then I could just send unreliable RPC to server in step 2 and that will solve the 2nd problem too? Should I do client-side hit detection also now since this will make better client experience? And then I will look for some other hack minimizing techniques which will not sacrifice the user experience.

It would be really helpful if someone could clear all these doubts as I haven’t found a proper explanation of this anywhere.

15 posts - 9 participants