The main aim is to keep the games variables server-side for obvious security reasons. I believe having server-side code to check before updating the games database values will protect me from classic game hacking methods.
To avoid clients sending direct updates to the database, the server first validates the clients requested actions.
The database keeps track of every Mobile & Item
The Server has all the game-logic
The clients simply render and work as controllers that send the server actions that wont occur unless validated by the servers logic.
Clients should only send the server "Action Request"
Server then checks the "Action Request" with two possible outcomes :
- Valid Request : Update DB and Re-send updated data to Clients for post-processing.
- Invalid Request : Notify the client that the Request was invalid.
I need to know if im thinking in the right tracks. Thanks.