I built a multiplayer fighting game with impactjs, socket.io and nodejs and faced with "change variables hack" (I want to call it like this). All my current logic with jump, running, shoot etc. is running on frontend, socket and nodejs just for creating a room.

How can I protect against a cheater changing variables on the client?

If you can share with code loke this it will be great :)

  • \$\begingroup\$ All my current logic [...] is running on frontend You should move everything to the server and have the front end act as a "dumb terminal". \$\endgroup\$
    – Vaillancourt
    Commented Sep 21, 2022 at 19:45
  • \$\begingroup\$ Rendering the canvas element on the server side is not a good solution to this problem. It will eat a lot of performance, cost a lot of bandwidth, and give you very choppy/laggy gameplay. Do you mean to ask "how can I protect against a cheater changing variables on the client?" \$\endgroup\$
    – DMGregory
    Commented Sep 21, 2022 at 20:56
  • \$\begingroup\$ @DMGregory Yes, how can I protect against a cheater changing variables on the client? \$\endgroup\$ Commented Sep 22, 2022 at 12:55
  • \$\begingroup\$ I'd recommend editing your question to ask that, instead of "can I render canvas element on server side?" - the answer to that is yes, but it's not the solution to your real problem. \$\endgroup\$
    – DMGregory
    Commented Sep 22, 2022 at 12:57
  • \$\begingroup\$ @Vaillancourt ok, what tools should I use? how can I dynamically change the game screen from the server? \$\endgroup\$ Commented Sep 22, 2022 at 12:58

1 Answer 1


This won't prevent all cheating but at least will make it harder for the average cheat engine/ change variable hack. Follow the simple advise: Don't trust the client.

Now what does that mean? Usually those hacks are about either freezing variables (your health does not go down when hit) or increasing them (money, ammo, consumables). This works in games where we trust the client to hold all important logic and variables. So we don't use that at the server. All the client should send is Player got hit by whom and from what. It is now the servers job to verify and do the math. Is the hit bringing down enough health to kill the player? Did the attacker had the ressource to make the attack? Once verified, the server would sent the result back and the games continue. You can still use the client as a prediction for players that don't cheat. But it can happen that a few frames later you would need to revert when the true state comes from the server.

Now this won't prevent players who are using aim bots, view hacks, manipulating hit boxes or similar. But those are way harder to code compared to simply changing variables. If you want/ need to verify as well the physics, you do not need to render the full canvas on your server. Most of the time it is possible to run it in a headless mode or server mode.

  • \$\begingroup\$ Hit detection on the client is weird. Particularly in multiplayer where just timing issues can cause inconsistencies, let alone malicious clients. The client should basically just send player inputs (e.g. shoot triggered). \$\endgroup\$
    – Jack
    Commented Sep 26, 2022 at 2:19
  • \$\begingroup\$ It totally depends on the type of game and the effort to recode what is already done. If the game is up and working, to recode everything to perform the hit detection on the server might not the worth the extra benefit. For a new game I totally agree. But the question reads that hit detection IS done client side and I'm pointing out the part OP wanted to fix: changing variables. \$\endgroup\$
    – Zibelas
    Commented Sep 26, 2022 at 7:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .