Handling player movment on the server instead of client?

[Ralph]

So I have a game, where movement and collision are big aspects. Currently I have a system where when a client say presses "W", body.velocity of their sprite is set to +150 in the x plane. Previously, my system for the multiplayer side of the game in terms of movement was when the player moves on the client side, send his new x & y position to the server. This was a great system, until I started turning the server into an authoritative one to prevent against hackers who could speed hack and set their own positions.

My new system is whenever a player hits "W" send to the server that this person is hitting W and then server calculates the players position (say adding 4 pixels for every W call to the players last position) and saves it on the server side. (Basically movement is on the server now). Now this is where it gets a bit hairy. Since I dont wait to get a response back form the server to move the player on the client side (bc that would cause terrible ping issues), whenever the player hits W, his REAL position (on the server) is calculated and saved to send to other players, and his "client position" the one that could potentially be hacked to move faster or teleport other places, is also moved just so i dont have to deal with ping issues. P.S This position is useless, it can be hacked or changed all it wants lol. Now this new system leads me to the following problem.

The issue with this new system is whenever i set the velocity of the client sided sprite, its speed doesn't correlate with the server, since on the server I have to move the player based on if they are hitting a key or not, and there is no way for me to know how long they are holding the key, I cant use velocity on the server, only say moving the  persons position 4 pixels every call of "W". However if i say switch to this system on the client, of setting a position 4 pixels away everytime they press W, instead of changing the velocity, I can sync up the client and server position perfectly. Butttt this creates the problem that my sprite can no longer collide with things because it is teleporting everywhere essentially. So Im stuck lol. 

Anyone have any ideas of how to handle this? Is there possibly a way i could do collision without velocity being set? Thanks for any help and sorry for poor language and bad grammar lol. Im insanely tired and just want some sleep rn

[oddkraken]

I think you need to calculate physics on the server, otherwise you're trusting the client's physics calculations. You could have the client do its own physics calculations for low latency movement, and periodically update the client with any corrections from the server.

[Skeptron]

8 hours ago, Ralph said:

there is no way for me to know how long they are holding the key

Of course there is : you should send a message to the server when the client presses the key, and another one when he releases the key.

[CtlAltDel]

This series explains it all  http://www.gabrielgambetta.com/fast_paced_multiplayer.html

[Raggar]

I was gonna post the same link as @CtlAltDel, as the demo seems to have this covered: http://www.gabrielgambetta.com/fpm_live.html

So far some people have had luck using P2.js for collision detection and other physics stuff server-side using Node.js.

I even thought about using it for a 3D game, to calculate the players' collisions with each other and the world. The reason for this is, that I haven't found a proper way to run a 3D world/physics server-side using Node.js yet. I'm just pretty sure it's not possible to calculate collisions on the Y axis (Z in 2D I think).

[Ralph]

3 hours ago, oddkraken said:

I think you need to calculate physics on the server, otherwise you're trusting the client's physics calculations. You could have the client do its own physics calculations for low latency movement, and periodically update the client with any corrections from the server.

Im already doing what you stated in the second part of your message, and the first part of your response is exactly what im asking to do lol

[Ralph]

2 hours ago, CtlAltDel said:

This series explains it all  http://www.gabrielgambetta.com/fast_paced_multiplayer.html

 

1 hour ago, Raggar said:

I was gonna post the same link as @CtlAltDel, as the demo seems to have this covered: http://www.gabrielgambetta.com/fpm_live.html

So far some people have had luck using P2.js for collision detection and other physics stuff server-side using Node.js.

I even thought about using it for a 3D game, to calculate the players' collisions with each other and the world. The reason for this is, that I haven't found a proper way to run a 3D world/physics server-side using Node.js yet. I'm just pretty sure it's not possible to calculate collisions on the Y axis (Z in 2D I think).

I dont understand, I already understand the concepts in this post, and am using some of them already, my issue is that I cant sync the client and server up if the client view is using velocity and the server cant. I cant tell the server "move right 1 unit" because that defeats the purpose of making the server authoritative anyway. All the client needs to tell the server is that it's pressing W and then the servers calculations should match the calculations done on the client. 

[symof]

Quote

I cant tell the server "move right 1 unit" because that defeats the purpose of making the server authoritative anyway. 

Although it's counter intuitive, this is how input works.

Client_01 does something (moves right 1 point) then sends the information to the server saying : "Hey! I want to move right 1 point. Can I do that?" then the server replies "yes" or "no" based on it's own authority (I.e. based on a number of conditionals that make sure such a move can happen).

If it's a yes then the database gets updated and everyone else playing on the server can see that Client_01 has done something, if the anwer is no then Client_01 goes back to the position that the server tells him to be at and the other clients notice nothing of all this.

That is how an authoritative server works. It basically has veto power over all the clients actions, as in, the client does not directly add data to the server, the server decides if the data should be added or ignored.

 

On the issue of the server not being able to use velocity, that just means you implemented a bad server for your needs.

[Ralph]

35 minutes ago, symof said:

On the issue of the server not being able to use velocity, that just means you implemented a bad server for your needs.

Lol wut, "implemented a bad server?" I cant use velocity because the physics are on the client and you cant run phaser on the server side (easily at least). On top of that Im running a simple node server with sockets to handle client/server lol, im unsure as to what you mean I implemented a "bad server"?

36 minutes ago, symof said:

Although it's counter intuitive, this is how input works.

Client_01 does something (moves right 1 point) then sends the information to the server saying : "Hey! I want to move right 1 point. Can I do that?" then the server replies "yes" or "no" based on it's own authority (I.e. based on a number of conditionals that make sure such a move can happen).

lol that's literally the exact same system I already have in place but instead of the client waiting for the server to allow it or not, the server just handles all the movement to begin with and I can cut out an entire step. Saving a lot of time. They are both correct, your way just takes longer.

This brings me back to the same problem, this method would work fine, if i could not use velocity, and just set the location of the player, but i cant do that because it breaks collision. I cant translate velocity into pixels per click of W because its movement is based on how long W is held in the first place.

The goal is to make the client essentially dummy code that takes input and gives it to the server to make calculations. By cutting out the step of waiting for the server to tell the client what it just did (I.e you just moved right 20 pixels), I can cut out a lot of latency issues by doing on the client the same calculations its doing on the server, and if there is a discrepency later, i can correct it, because i couldnt care if the player is moving a million miles per hour on their screen or is teleporting around the map, the map data is based on their location form the server so they cant see anything extra or actually be there. 

[Raggar]

If you use the p2.js engine, you can run that both client- and server-side.

Then the calculations should all be the same.

[Ralph]

57 minutes ago, Raggar said:

If you use the p2.js engine, you can run that both client- and server-side.

Then the calculations should all be the same.

I looked into this however I didnt really understand how to use it, I see how the client side works but I didnt understand how I could use this on the server? 

Here is the package for any spectator of the discussion: https://www.npmjs.com/package/p2

[CtlAltDel]

Client and server should both run the same simulation. Server is authorative, so it sends the results of it's simulation including the point in time where that was and the client predicts from there again running the sim. I am not sure if p2 is suited for this. For my own multilplayer tech demo I wrote my own simple 'physics' it's a topdown shooter so basically only collisions with walls mattered and how they affect the character movement. 

[Ralph]

On 7/29/2016 at 1:34 AM, CtlAltDel said:

Client and server should both run the same simulation. Server is authorative, so it sends the results of it's simulation including the point in time where that was and the client predicts from there again running the sim. I am not sure if p2 is suited for this. For my own multilplayer tech demo I wrote my own simple 'physics' it's a topdown shooter so basically only collisions with walls mattered and how they affect the character movement. 

Ya this is correct. The best way to do it is indeed prediction. However I cant run te simulation on the server due to the fact that there is no velocity lol. 

 

Either way, I came up with a decent solution to my problem, for now Ill have the client handle its own movement, but when it sends it to the server, the server just makes sure the client is less than or equal to 2.5 pixels away from its last position (syncing perfectly with velocity = 150, at velocity =151 my anti speed hack kicks in, so this is ok with me for now).

[Skeptron]

This solution is terrible. You'll hammer the server with unnecessary calls, and everything will break when players will lag : and trust me, they WILL.

I don't understand your statement " However I cant run the simulation on the server due to the fact that there is no velocity lol.". It makes no sense. There is on the server whatever you decide to put there. If you want velocity on the server side, then be it. It's only up to you.

[Ralph]

On 7/30/2016 at 0:46 PM, Skeptron said:

This solution is terrible. You'll hammer the server with unnecessary calls, and everything will break when players will lag : and trust me, they WILL.

I don't understand your statement " However I cant run the simulation on the server due to the fact that there is no velocity lol.". It makes no sense. There is on the server whatever you decide to put there. If you want velocity on the server side, then be it. It's only up to you.

Actually its not terrible, I did some testing before actually implementing it to make sure the server can handle it, it can. With 20 clients online and running around the server is only pushing 20% cpu usage and with only 2 clients online it idles at around 10. I understand its bad for performance, but for now this is alright. Sidenote, the server isnt handling movement unless the player has a key pressed down, so its not always checking every player, only ones attempting to move. 

Furthermore, nothing "breaks" when players lag, only rubber banding which is a common thing in nearly all multiplayer game with any form of anti cheat. If the player is lagging then yes there will be rubber banding but that's the cost of making sure the player isn't actually moving faster, and would probably still be there even if i find a better solution than my current one; nothing 'breaks.'

And finally, your solution of "just put velocity on the server" is an insanely useful tip. It never really occurred to me. Lol If it was that simple, I would already be working on it. I cant get velocity on the server side because I cant transfer the calls that phaser takes in locally to handle movement to the server without opening myself up to other forms of hacking. Phaser's velocity relies on knowing how long a key has been pressed down, mass of the objects, gravity etc. Optimally i would need the majority of the arcade physics system on the server, which according to my knowledge is impossible. There is that p2 physics engine that someone linked earlier, but I dont really understand how thats useful because it just seems like a client side physics engine. On top of that, this system i have setup is great because collision doesn't need to be handled by the server, If the player is running into something all the server knows is that the client isn't moving anymore. If i switch to another system I would likely have to figure out a way to handle collision on the server side, so when the client is pressing "w" and is colliding with a rock, the server doesn't think its walking right through it. 

If you know something I don't know about making this work please help me out here, because so far all the suggestions on this thread havent been too useful. 

[Ralph]

In fact, @Skeptron you commented on another one of my threads asking how I can prevent about hackers, and you gave me this advice: 

Quote

I'd add that you also never want the clients to send anything else than the controls they may press. A player should never send "Go to x:120/y:744" or "Deal 75dmg". They should only send "I pressed Q" or "I clicked at x:120/y:744". The server will know what to do with these actions and can't be cheated into using false coordinates or values.

I didn't realize that was you, but I really took that advice to heart and essentially converted my entire game into a client that is just a viewing port and a control taker. This system I have in place for movement is currently the simplest way I know i can stick to this advice, and at the cost of performance, I know players can no longer tp around or speed hack. 

Edit: Thread described: http://www.html5gamedevs.com/topic/23413-ways-to-prevent-against-hackers/#comment-133817

 

[Skeptron]

Making a real, competitive multiplayer engine is a real, REAL challenge. I know that because I've been working on one of my own for the past months. It's super hard and requires a good understanding of programming.

If you didn't read those articles, you have to (absolutely) : 

http://buildnewgames.com/real-time-multiplayer/

http://www.gabrielgambetta.com/fpm4.html

https://developer.valvesoftware.com/wiki/Source_Multiplayer_Networking

They depict the real ways of doing a multiplayer engine. Once you're at ease with the notions, come back for more questions!

 

[symof]

20 hours ago, Ralph said:

I cant get velocity on the server side because I cant transfer the calls that phaser takes in locally to handle movement to the server without opening myself up to other forms of hacking. 

I will try and explain this again, because you seem to be missing the point of an authoritative server.

First we need some clients and a server.

The clients are Fred and Barney and the server is Mr.Slate .

Now let's say that Fred and Barney are working in a stone quarry and Mr. Slate is the boss. Fred and Barney can each act individually as they extract the stone. Mr. Slate as the boss can see everything happening there. 

If Fred does something he shouldn't do then Mr. Slate will call Fred to his office and set him straight or fire him.

 

Seriously tho. You just need to sync the information. If you send just "client presed w" or "client pressed w AND his current speed is 150, with no sign of him taking his finger off the keyboard", you will open yourself to the same amount and forms of hacking.

The server should see everything that ALL clients do. The client see,s only what he is doing AND what the server wants him to see.

 

 

[Ralph]

5 hours ago, symof said:

Seriously tho. You just need to sync the information. If you send just "client presed w" or "client pressed w AND his current speed is 150, with no sign of him taking his finger off the keyboard", you will open yourself to the same amount and forms of hacking.

The server should see everything that ALL clients do. The client see's only what he is doing AND what the server wants him to see.

You are confused, this is literally the exact system i have in place right now lol. Im no longer using either system you described above (for movement) i'm using the system i detailed very specifically above. The server currently does see everything the clients do, my client is now fully a hollow shell that sends any for of input that i want to take to the server then the server handles it and send other clients what they need to know. The thing with movement was I couldn't adapt the same approach and like i said above, I settled for just sending player positions every time the player moved and making sure on the server that that move was legitament. 

[Skeptron]

But how can the server know that the move is "legit" if the server doesn't run the physics of the game? How can he know that the new move of the player is correct with just the distance ran? What if the player is cheating and going through a wall? Or moving despite being stun/root?

You can't be authoritative if you don't run the game on your own. The server must have the rules of the game and run it. No matter how hard this sounds, it's the only way you can have a fully authoritative server. Period. Anything else is a weak implementation and open to cheat, if not to lag issues.

[Raggar]

This is something both Phaser and Babylon need. A proper open source authoritative server with at least working physics.

I've seen this being discussed various places, with implementation in Java, C++, Python etc. But so far, I haven't seen any actual code examples.

I'm certain this would boost popularity of both frameworks, but at the same time, it's no small task. Community project, anyone?

[danneu]

I've been trying to build a multiplayer game over the last few months (weekends).

My first attempt was a 100% authoritative server where only the server ran the simulation and clients only send inputs. But it was kinda discouraging that the Hello World version of my game was already unplayable due to input lag as OP pointed out. Also, implementing a client-side simulation later on in the project was a tall order since it involved a massive refactor.

My current rewrite attempt involves a simulation on the server and on the client from day 1 while splitting authority between the server and client. For example, clients are the authority on their position. They simulate their local game (no input lag) and broadcast their position to the server. The server is the authority on other things, like whether a bomb kills an enemy and whether a player picks up a CTF flag.

This seems to be the simplest way to start since I've found it much easier to migrate authority as needed than to add a simulation to the server or client in a later step. It's also closer to what the end result will look like and sets you up nicer for client-side prediction (once you migrate position authority from client to server).

It's clear to me that lag compensation + no client authority is the hardest technical challenge in a multiplayer game, so I reckon it's worthwhile to postpone it. After all, nobody is going to cheat in an unreleased game or one that nobody plays.

[symof]

1 hour ago, danneu said:

I've been trying to build a multiplayer game over the last few months (weekends).

My first attempt was a 100% authoritative server where only the server ran the simulation and clients only send inputs. But it was kinda discouraging that the Hello World version of my game was already unplayable due to input lag as OP pointed out. Also, implementing a client-side simulation later on in the project was a tall order since it involved a massive refactor.

My current rewrite attempt involves a simulation on the server and on the client from day 1 while splitting authority between the server and client. For example, clients are the authority on their position. They simulate their local game (no input lag) and broadcast their position to the server. The server is the authority on other things, like whether a bomb kills an enemy and whether a player picks up a CTF flag.

This seems to be the simplest way to start since I've found it much easier to migrate authority as needed than to add a simulation to the server or client in a later step. It's also closer to what the end result will look like and sets you up nicer for client-side prediction (once you migrate position authority from client to server).

It's clear to me that lag compensation + no client authority is the hardest technical challenge in a multiplayer game, so I reckon it's worthwhile to postpone it. After all, nobody is going to cheat in an unreleased game or one that nobody plays.

http://www.gabrielgambetta.com/fast_paced_multiplayer.html

That tutorial explains in very clear terms how to build an authoritative server.

Make it right from day 1 don't postpone it and hope that you can fix it "when you release". Do it right the first time so you don't have to go back and alter it again and again.

Splitting authority between the server and client will cause you more problems in the long run than anything else.

[Ralph]

14 hours ago, Skeptron said:

But how can the server know that the move is "legit" if the server doesn't run the physics of the game? How can he know that the new move of the player is correct with just the distance ran? What if the player is cheating and going through a wall? Or moving despite being stun/root?

You can't be authoritative if you don't run the game on your own. The server must have the rules of the game and run it. No matter how hard this sounds, it's the only way you can have a fully authoritative server. Period. Anything else is a weak implementation and open to cheat, if not to lag issues.

To be honest, I didn't actually think about the moving through walls part. The stun/root is taken care of server side already along with player health (damage taken etc). But it just occurred to me that currently my system stops people from teleporting distances longer than what what they could by walking, but if someone setup a loop to teleport them within that distance they would be able to go through walls and the server wouldn't be able to tell.

Without giving too much thought to it right now, my map is generated server side in a chunk format, so I could set up a system where every time the player moves into a new chunk, I could define all the places the player cannot be and if the player is inside of those illegal bounds, handle it. Again, i haven't given it much thought and this could be costly to performance. Either way, dunno how i would handle it with anything radically different because, once again, without having physics on the server to know that these two sprites are colliding, there is no great way for me to do it.

As I wrote that I realized, phaser also supports a overlapping feature, and that could be used to detect if a player is teleporting around, because it's only called if a player is, like the name states, overlapping with another sprite, and that is impossible currently if they are using velocity, as they will collide not overlap with other sprites. Before I say anything else, I would like to say, really the method of hacking im currently working to counteract is doing things from the console (even if everything is wrapped in an anonymous function) or running other scripts over the game at the same time etc. Im not exactly sure how far a player could go into actually modifying the source javascript to block things from running or changing the source in real time, so this may not work, but I could potentially send a flag to the server if the player is overlapping with somethign and then the server check to see if its doing anything fishy, but like I said this is probably unreliable because it would be the hacker's own client flagging itself.

Another possibility I just had could be to outsource the cpu power lol. I could every say 10 seconds randomly assign one player the duties of monitoring another players movement and making sure that it is legit and they arent going through walls or anything and let the server handle regular old walking. I could keep the players anonymous and just send the data they need to know to make sure they arent hacking to the client, and by keeping it on a cycle that switching the player you are monitoring randomly you couldnt really get a friend or something to hack their client to legitimize your movement, easily at least. 

Just some ideas 

[Ralph]

1 hour ago, danneu said:

My current rewrite attempt involves a simulation on the server and on the client from day 1 while splitting authority between the server and client. For example, clients are the authority on their position. They simulate their local game (no input lag) and broadcast their position to the server. The server is the authority on other things, like whether a bomb kills an enemy and whether a player picks up a CTF flag.

Yes I like this system as well, and is the current one I am using. Run the simulation on both and make sure its a legal simulation on the server, if it is, no need to correct the client, if it isnt, do something about it, even if its 100ms behind.