Should damage calculation in a competitive multiplayer game be done client-sided or server-sided?

Question

I'm interested in creating a moba style game like League of Legends and need help with a situation. More exactly: I have an item that gives the player 50 Attack Damage or an ability that does 50 Attack Damage. Is the information about how much damage the items/ champion abilities do kept in client side of the game or the server.

Option 1: I hit the enemy and the client tells the server to deduct 50HP from the enemy i hit
or
Option 2: I hit the enemy and the client tells the server only that I hit the enemy, then the server looks at the item I have/ ability used and based on code on the serves side deducts the 50HP

Answer 1

Rule number one for multiplayer netcode design: Anything that matters for gameplay should be calculated server-sided. Never trust the client. The client is in the hands of the enemy. You can not efficiently prevent players from modifying their game client to gain an advantage.

The only reasons why you would do damage calculation on the client are:

• Your game is completely deterministic, so cheating can be detected by the other clients (but this usually only applies to turn-based games - with real-time games, the network latency alone will introduce a certain degree of randomness which makes remote cheat detection difficult)
• You do it both server-sided and client-sided so you can show the player the results the server is very likely going to conclude as well without latency (but the server-sided results count when there is a disagreement).
• You don't care about cheaters ruining your game and consider it more important to minimize your server cost.

Answer 2

Option 3: The client sends a click event to the server, the server decides where this click event has landed, decides if there is a hit or a miss, then applies the damage and sends the updated world state back to the client.

Don't even trust the client to tell if there is a hit or a miss.

Answer 3

It depends on what security level you want to implement. The games you mentioned surely have all that code on the server side to make the game more secure against hackers. Because now the hackers have to attack the server, which are highly guarded against attacks instead of hacking the client, which would be much easier.

Answer 4

Option 4: Send the individual input events to the server to let it make authoritative decisions, but also process and display those actions locally so the local user doesn't see any lag. Both client and server messages about this stuff need time stamps, mostly so the client can fudge things to make it look smoother.

(it turns out this is just a combination of things others have already mentioned... bah!)

The client and server code should be shared to the degree possible. Any time the client and server come to different decisions, it should be due to lag, not code.

Answer 5

Calculate everything on the server

That is: you tell the server where you want to move and who you want to attack (if abilities are targeted, as many are with MOBAs) or in which direction (if the ability is aimed directionally, like in most first-person shooters on PC). The server will then calculate whether your move is valid (i.e. it's actually possible to move that far) and whether your attack hits, how much damage is done (including critical hits) and whether anything else needs to happen (e.g. an attack could freeze the target or push them away).

Why?

• Cheating

  People might try to cheat by telling the server they're doing a lot more damage than possible. The server keeping track of this information is required to prevent this.

• Multiple clients doing their own calculations would be messy

  Let's say I try to attack you, but I have latency of a few seconds. You moved out of range a while ago, but I still see you next to me, so that attack would be valid from my point of view.

  Now I tell the server to subtract some of your health. Now what? Should the server do that and suddenly you take a bunch of damage despite no-one being around you any more? Or should the server realise the attack isn't valid any more and send back to me that you suddenly regain the health I already subtracted? Neither option would be a good user experience (you shouldn't be playing with that much lag, but lag spikes happen, and the problem also exists with lower latency).

  The above applies to whether or not you hit, but a similar problem happens with regard to how much damage is done: We're attacking each other and I see you lose all your health while I still have a bunch. So I won that fight, right? But you, on the other hand, see the same (due to the update delay between us, and each of us only know about the damage we're dealing). So you also won? There isn't a good way to resolve that either.

---

Footnote regarding calculating on both the client and server:

In some cases in these games, some calculations happen on the client as well as the server, to reduce lag (so the client can update without waiting for the server). The states would then be synchronised between the two (which sometimes results in "desync", where you jump backwards to where you were a few seconds ago - you may have seen this in one of many popular games).

For your own movement, this could make sense, as you know where you're currently busy moving and there isn't (much) probabilities involved in how that happens. It would only a big problem when there's a significant delay, which is assumed to be an exception rather than the norm, and the alternative would having a very irritating delay on every single move you make (even if your latency is fairly low).

Damage, on the other hand, needs to consider where the target is, whether they're still alive, whether you actually hit them (if I generate a number, or roll some dice, which says I hit and the server does the same to determine that I miss, there is a problem), or did a "critical hit" , any modifiers that might be affecting how much damage is done and possibly other factors. If you try to do the calculation on both the client and server, health counters would constantly jump up and down when the client guesses some of these things wrong, which would arguably be a much worse experience than just having the damage take a little while to show up on the target.

That's not to say it's completely nonviable to do the calculation on both in some scenarios, it's just quite a bit harder in a lot of cases than doing the same for movement (which is already nontrivial).