I built a multiplayer fighting game with impactjs, socket.io and nodejs and faced with "change variables hack" (I want to call it like this). All my current logic with jump, running, shoot etc. is running on frontend, socket and nodejs just for creating a room.
How can I protect against a cheater changing variables on the client?
If you can share with code loke this it will be great :)
This won't prevent all cheating but at least will make it harder for the average cheat engine/ change variable hack. Follow the simple advise: Don't trust the client.
Now what does that mean? Usually those hacks are about either freezing variables (your health does not go down when hit) or increasing them (money, ammo, consumables). This works in games where we trust the client to hold all important logic and variables. So we don't use that at the server. All the client should send is Player got hit by whom and from what. It is now the servers job to verify and do the math. Is the hit bringing down enough health to kill the player? Did the attacker had the ressource to make the attack? Once verified, the server would sent the result back and the games continue. You can still use the client as a prediction for players that don't cheat. But it can happen that a few frames later you would need to revert when the true state comes from the server.
Now this won't prevent players who are using aim bots, view hacks, manipulating hit boxes or similar. But those are way harder to code compared to simply changing variables. If you want/ need to verify as well the physics, you do not need to render the full canvas on your server. Most of the time it is possible to run it in a headless mode or server mode.
