Search Unity

  1. Unity 6 Preview is now available. To find out what's new, have a look at our Unity 6 Preview blog post.
    Dismiss Notice
  2. Unity is excited to announce that we will be collaborating with TheXPlace for a summer game jam from June 13 - June 19. Learn more.
    Dismiss Notice

Question Matchmaking with servers, client vs server tickets

Discussion in 'Matchmaker' started by jackward84, Jun 16, 2023.

  1. jackward84


    Jan 26, 2017
    Title is bad because I realised if the player is not already connected to a server then there's no way they can ask the server to create them a ticket. But essentially what I'm asking about boils down to this:

    I had a thought, which may be incorrect (and please correct me if I am incorrect!), that there is essentially no real "authentication" (or as far as I am aware, deduplication) happening on these matchmaking tickets. If I were to figure out the payload of the matchmaker, I could essentially spam tickets with different UserIds (potentially they don't even need to be different IDs - not sure at the moment) to flood the matchmaker with requests. At which point the matchmaker would start looking for servers to allocate to those IDs, and if a server is not found it would spin up servers all the way to the fleet cap.

    Which, if I'm correct, would be a terrible thing. A single player could essentially perform a denial of service on the game by using up every allocation available (not to mention that this would cost me a lot of money).

    How am I supposed to handle this, or am I completely wrong about this system?
    Last edited: Jun 16, 2023