I'm interested in creating a moba style game like League of Legends and need help with a situation. More exactly: I have an item that gives the player 50 Attack Damage or an ability that does 50 Attack Damage. Is the information about how much damage the items/ champion abilities do kept in client side of the game or the server.

Option 1: I hit the enemy and the client tells the server to deduct 50HP from the enemy i hit
Option 2: I hit the enemy and the client tells the server only that I hit the enemy, then the server looks at the item I have/ ability used and based on code on the serves side deducts the 50HP

  • 10
    \$\begingroup\$ Imagine you're the server, and I tell you I just dealt 9999999999999 damage to my opponent. Should you believe me? How will you know if I'm telling the truth? \$\endgroup\$
    – DMGregory
    May 7, 2019 at 19:18
  • 2
    \$\begingroup\$ I would argue that you do not even tell the server you hit the enemy, you just tell it what attack you do and the server decides if it hits. \$\endgroup\$
    – Theraot
    May 7, 2019 at 21:01
  • \$\begingroup\$ See also The state that is synced when a window is broken in a FPS game \$\endgroup\$
    – Theraot
    May 7, 2019 at 21:19
  • 2
    \$\begingroup\$ @DMGregory The answer to that is simple: the opponent will develop a better cheat program that will tell the server that they have 9999999999999+1 armour. \$\endgroup\$
    – Vaillancourt
    May 8, 2019 at 1:06
  • \$\begingroup\$ sidenote - a good example for a serverside game is World of Tanks, if you want to check out an existing game. \$\endgroup\$
    – Baldrickk
    May 8, 2019 at 11:08

5 Answers 5


Rule number one for multiplayer netcode design: Anything that matters for gameplay should be calculated server-sided. Never trust the client. The client is in the hands of the enemy. You can not efficiently prevent players from modifying their game client to gain an advantage.

The only reasons why you would do damage calculation on the client are:

  • Your game is completely deterministic, so cheating can be detected by the other clients (but this usually only applies to turn-based games - with real-time games, the network latency alone will introduce a certain degree of randomness which makes remote cheat detection difficult)
  • You do it both server-sided and client-sided so you can show the player the results the server is very likely going to conclude as well without latency (but the server-sided results count when there is a disagreement).
  • You don't care about cheaters ruining your game and consider it more important to minimize your server cost.
  • \$\begingroup\$ RTS games are typically deterministic and simulated in parallel by all players. \$\endgroup\$
    – Kromster
    May 8, 2019 at 7:13
  • 2
    \$\begingroup\$ A fourth option: calculating is somehow more expensive than verifying. Then you could leave the calculating to clients, and do verification only on the server. Doesn't seem very likely for damage calculations to be honest, but still. \$\endgroup\$
    – Mark
    May 8, 2019 at 9:27
  • \$\begingroup\$ @Philipp This answer would benefit from describing specifically what should happen server side in this situation. (Presumably both the damage and the hit/miss determination.) \$\endgroup\$ May 8, 2019 at 16:38
  • \$\begingroup\$ To reiterate, never ever trust the client. This is one of the shortcomings of the Planetside franchise... client side hit detection makes it relatively easy to cheat. I understand the original had a lot of customer service reps monitoring player activity to track down cheaters and punish them (until their funding got cut). But if you want 600+ players on a server all capable of firing full auto, you really can't process all that on the server. Maybe if you shuffled it all off to a gpu, but then the round trip time starts to suffer, to say nothing of setting up all the collision data. \$\endgroup\$ May 22, 2020 at 19:06

Option 3: The client sends a click event to the server, the server decides where this click event has landed, decides if there is a hit or a miss, then applies the damage and sends the updated world state back to the client.

Don't even trust the client to tell if there is a hit or a miss.


It depends on what security level you want to implement. The games you mentioned surely have all that code on the server side to make the game more secure against hackers. Because now the hackers have to attack the server, which are highly guarded against attacks instead of hacking the client, which would be much easier.

  • \$\begingroup\$ This is the reason I asked is I was talking to a friend of mine that plays CS GO and knows game programming and how to make cheats for SC GO. He was showing me how he makes the enemy team render when they aren't in front of him and told me that he can not mess with the HP and damage dealt because is on the server side. He actually modified the HP that he had after intentionally taking damage and immediately after the game changed it to what it was before he modified it \$\endgroup\$
    – NameHere
    May 7, 2019 at 19:32

Option 4: Send the individual input events to the server to let it make authoritative decisions, but also process and display those actions locally so the local user doesn't see any lag. Both client and server messages about this stuff need time stamps, mostly so the client can fudge things to make it look smoother.

(it turns out this is just a combination of things others have already mentioned... bah!)

The client and server code should be shared to the degree possible. Any time the client and server come to different decisions, it should be due to lag, not code.

  • \$\begingroup\$ I understand that "Rocket League" works this way, all the player input is evaluated on the server and simulated on the client, with lots of client-side smoothing to make it look good. \$\endgroup\$ May 22, 2020 at 19:07

Calculate everything on the server

That is: you tell the server where you want to move and who you want to attack (if abilities are targeted, as many are with MOBAs) or in which direction (if the ability is aimed directionally, like in most first-person shooters on PC). The server will then calculate whether your move is valid (i.e. it's actually possible to move that far) and whether your attack hits, how much damage is done (including critical hits) and whether anything else needs to happen (e.g. an attack could freeze the target or push them away).


  • Cheating

    People might try to cheat by telling the server they're doing a lot more damage than possible. The server keeping track of this information is required to prevent this.

  • Multiple clients doing their own calculations would be messy

    Let's say I try to attack you, but I have latency of a few seconds. You moved out of range a while ago, but I still see you next to me, so that attack would be valid from my point of view.

    Now I tell the server to subtract some of your health. Now what? Should the server do that and suddenly you take a bunch of damage despite no-one being around you any more? Or should the server realise the attack isn't valid any more and send back to me that you suddenly regain the health I already subtracted? Neither option would be a good user experience (you shouldn't be playing with that much lag, but lag spikes happen, and the problem also exists with lower latency).

    The above applies to whether or not you hit, but a similar problem happens with regard to how much damage is done: We're attacking each other and I see you lose all your health while I still have a bunch. So I won that fight, right? But you, on the other hand, see the same (due to the update delay between us, and each of us only know about the damage we're dealing). So you also won? There isn't a good way to resolve that either.

Footnote regarding calculating on both the client and server:

In some cases in these games, some calculations happen on the client as well as the server, to reduce lag (so the client can update without waiting for the server). The states would then be synchronised between the two (which sometimes results in "desync", where you jump backwards to where you were a few seconds ago - you may have seen this in one of many popular games).

For your own movement, this could make sense, as you know where you're currently busy moving and there isn't (much) probabilities involved in how that happens. It would only a big problem when there's a significant delay, which is assumed to be an exception rather than the norm, and the alternative would having a very irritating delay on every single move you make (even if your latency is fairly low).

Damage, on the other hand, needs to consider where the target is, whether they're still alive, whether you actually hit them (if I generate a number, or roll some dice, which says I hit and the server does the same to determine that I miss, there is a problem), or did a "critical hit" , any modifiers that might be affecting how much damage is done and possibly other factors. If you try to do the calculation on both the client and server, health counters would constantly jump up and down when the client guesses some of these things wrong, which would arguably be a much worse experience than just having the damage take a little while to show up on the target.

That's not to say it's completely nonviable to do the calculation on both in some scenarios, it's just quite a bit harder in a lot of cases than doing the same for movement (which is already nontrivial).


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .