Search Unity

  1. Unity 6 Preview is now available. To find out what's new, have a look at our Unity 6 Preview blog post.
    Dismiss Notice
  2. Unity is excited to announce that we will be collaborating with TheXPlace for a summer game jam from June 13 - June 19. Learn more.
    Dismiss Notice

Question Is a client's clientid only known by itself and the server? Or can cheating clients know it too

Discussion in 'Multiplayer' started by CR0N14, Jan 26, 2024.

  1. CR0N14

    CR0N14

    Joined:
    Sep 23, 2021
    Posts:
    6
    Context: I'm making a pvp strategy game using NGO, still learning the basics of NGO.

    Use case: The server knows how much gold each player (client) has. Player A sends a ServerRPC requesting to spend 50 gold. The server knows Player A is the sender based on its clientid, and deducts the gold amount for Player A. My question is: is this clientid only known by Player A and the server? Can a cheating Player B find out Player A's clientid, and use it to 'pretend' to be Player A and send ServerRPCs to deduct Player A's gold?

    Side note: is clientid the main way I reference and distinguish players in my logic on the server?
     
  2. bugfinders

    bugfinders

    Joined:
    Jul 5, 2018
    Posts:
    2,036
    You could do a test, see if the client can extract the IDs.
     
  3. cerestorm

    cerestorm

    Joined:
    Apr 16, 2020
    Posts:
    676
    The server sets the clientId for each client connection so no it's not possible to send data on one connection pretending to come from another. The client doesn't specify the sending clientId when sending a ServerRpc.
    You can but you might want a separate identifier in case for example a player drops and reconnects where they would then have a new clientId.
     
  4. bugfinders

    bugfinders

    Joined:
    Jul 5, 2018
    Posts:
    2,036
    @cerestorm I believe it does if you follow
    Code (CSharp):
    1. [ServerRpc(RequireOwnership = false)]
    2. public void MyGlobalServerRpc(ServerRpcParams serverRpcParams = default)
     
  5. cerestorm

    cerestorm

    Joined:
    Apr 16, 2020
    Posts:
    676
    That gets filled out on the server side as far as I can remember, and also going by the docs:
    Code (CSharp):
    1.    MyGlobalServerRpc(); // serverRpcParams will be filled in automatically
     
  6. bugfinders

    bugfinders

    Joined:
    Jul 5, 2018
    Posts:
    2,036
    Well that doc says it because the parameters include the default filled in parameter, but it has to be there or it doesnt send it.
     
  7. cerestorm

    cerestorm

    Joined:
    Apr 16, 2020
    Posts:
    676
    I don't think it gets sent at all, at least not the clientId, it's just a easy way to identify the sender of the rpc by the server.
     
  8. bugfinders

    bugfinders

    Joined:
    Jul 5, 2018
    Posts:
    2,036
  9. cerestorm

    cerestorm

    Joined:
    Apr 16, 2020
    Posts:
    676
    It does, but it doesn't come from the client, the server populates the value itself on receipt of the rpc. It actually wouldn't make sense for the server who already knows which client sent the message to trust the client to provide the clientId.
     
  10. bugfinders

    bugfinders

    Joined:
    Jul 5, 2018
    Posts:
    2,036
    I got the impression the client filled it as it is the client that called it.. i guess either way it is semantics but it does include who sent the command, so it is available
     
  11. cerestorm

    cerestorm

    Joined:
    Apr 16, 2020
    Posts:
    676
    I had a look at the api just to be sure. The serverRpcParams.Send would be data coming from the client but it's never been implemented, serverRpcParams.Receive is filled out by the server and has just the clientId field.