I'm doing a simple idle game, HTML5 client and Node.js server, but I'm making it online, where the client talks to the server (websockets) and all the logic is in the server (I want to prevent cheating as much as possible, because I want to have leaderboards).

My idea is, when the player X attacks the mob Y and it hits for 10 (should gain 10xp), so I send that via websocket, "playerX|10". How do I validate the input, so that a cheater can't just send "playerX|100000000".

Also how do I handle mob deaths? Do I send a "playerX,mobY" and the server replies with a drop?

Am I worrying too much about security? The golden rule is never trust the client, but how?

I'm thinking maybe all the client does is send actions?

message: attack|mobY, and the server calculates everything, xp gains, hit values, but I still don't know how to handle mob death, without having to keep state for the current "fight" with that mobY.

Sorry if I'm not clear enough. If you can share some thoughts or articles about this stuff, I'll be very glad!


1 Answer 1


When you want a cheating-proof client/server game, then you need to handle all game mechanics which are worth cheating on the server.

Don't send "Player X hits enemy Y for Z damage". Just send "Player X attacks enemy Y". Leave the damage calculation to the server. Then tell the client how much damage they made and whether or not the mob is still alive and when it is dead how much exp the player has now. If you are limiting attack speed, then the server should also check how long ago the last attack was. But keep in mind that you can not rely on network latency being constant. So when you receive an attack-command which is 3 ms too early, don't just reject it. Execute it 3 ms later.

  • 1
    \$\begingroup\$ Or, if "missing" is a concept in your game, then instead of "Player X hits enemy Y" it would be "Player X attacks enemy Y" and the server decides for itself whether it was a hit. \$\endgroup\$
    – DMGregory
    Aug 19, 2018 at 20:36
  • \$\begingroup\$ ok, so i need to keep state of the fight on the server. would you say a simple Object {[playerId]: { action: attack, mobId: Y, lastAttack: }}. would this handle well if i have 10k players? \$\endgroup\$
    – franmcod
    Aug 19, 2018 at 22:52
  • \$\begingroup\$ @franmcod Why send the player ID? You certainly don't want a client to perform actions for a different player than the one it represents, do you? How well this scales is hard to tell. There are too many unknowns. \$\endgroup\$
    – Philipp
    Aug 19, 2018 at 23:03
  • \$\begingroup\$ @Philipp then how would you authenticate the player? http headers, access_token? \$\endgroup\$
    – franmcod
    Aug 19, 2018 at 23:13
  • \$\begingroup\$ @franmcod That's out of scope for this question. You might want to ask this as a new one. \$\endgroup\$
    – Philipp
    Aug 19, 2018 at 23:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .