I am currently developing a multiplayer game for a university project. The purpose of the assignment is to learn about how to use clusters, but I have a question concerning security.

This multiplayer role-playing game utilizes a client-server architecture. The client holds all of the game assets and a 2D game engine. The server provides authentication to log into a user account, provides access to characters and their progression, etc. The server also provides the positions of NPCs and other players on the same server and provides their actions.

My question is whether a tech savvy user that modified the source code of the client could "play the game" without authenticating, forcing a kind of single player version of my game? I am imagining a user sending the client his/her own custom information about where to spawn enemies and whatnot. Maybe he/she would simply want to move around the game world freely.

1. Does this scenario seem possible?

2. Most importantly, what harm could this cause to a multiplayer game? Perhaps I have content that I don't want someone to be able to access without properly purchasing the game, or if they have been banned for some reason.

3. If this is a problem I should try to mitigate, how could I go about preventing this kind of thing from happening?

I am currently developing a multiplayer game for a university project. The purpose of the assignment is to learn about the use of a cluster architecture, but I have a question concerning security.

The multiplayer role-playing game that I'm developing for class utilizes a client-server architecture. The client holds all of the game assets and a 2D game engine. The server provides authentication to log into a user account, provides access to characters and their progression, etc. The server also provides the positions of non-player characters and other players on the same server, and also provides their actions and movements.

My question is whether a tech savvy user that modified the source code of the client could "play the game" without authenticating, forcing a kind of single player version of my game? I am imagining a user sending the client his/her own custom information about where to spawn enemies and whatnot. Maybe he/she would simply want to move around the game world freely.

1. Does this scenario seem possible?

2. Most importantly, what harm could this cause to a multiplayer game? Perhaps I have content that I don't want someone to be able to access without properly purchasing the game, or if they have been banned for some reason.

3. If this is a problem I should try to mitigate, how could I go about preventing this kind of thing from happening?