Search Unity

  1. Unity 6 Preview is now available. To find out what's new, have a look at our Unity 6 Preview blog post.
    Dismiss Notice
  2. Unity is excited to announce that we will be collaborating with TheXPlace for a summer game jam from June 13 - June 19. Learn more.
    Dismiss Notice

Question Matchmaking with servers, client vs server tickets

Discussion in 'Matchmaker' started by jackward84, Jun 16, 2023.

  1. jackward84

    jackward84

    Joined:
    Jan 26, 2017
    Posts:
    87
    Title is bad because I realised if the player is not already connected to a server then there's no way they can ask the server to create them a ticket. But essentially what I'm asking about boils down to this:

    I had a thought, which may be incorrect (and please correct me if I am incorrect!), that there is essentially no real "authentication" (or as far as I am aware, deduplication) happening on these matchmaking tickets. If I were to figure out the payload of the matchmaker, I could essentially spam tickets with different UserIds (potentially they don't even need to be different IDs - not sure at the moment) to flood the matchmaker with requests. At which point the matchmaker would start looking for servers to allocate to those IDs, and if a server is not found it would spin up servers all the way to the fleet cap.

    Which, if I'm correct, would be a terrible thing. A single player could essentially perform a denial of service on the game by using up every allocation available (not to mention that this would cost me a lot of money).

    How am I supposed to handle this, or am I completely wrong about this system?
     
    Last edited: Jun 16, 2023