Verify user actions - security

[TomaszFurca]

Hi, I writing my RPG game, now is time to do something about security. I have problem with scenario attack player and monsters movements. I using socket IO.

When player moving monster attack area intersection is checking on client side, so i think is not secure, because user can block this event. Then monster newer go to player location and don't attack him. Next problem is attack of player, when player attack collision is check on client side - it can be verify on server, which monsters you can attack on actual player position and how many times you can attack in some time.

So i have some questions.

What you think about create monster server - socket io client, which connect with socket io server of game, which get player and monsters positions. On monster server I run BABYLON engine with simple boxes, which reconstruct real scene - then monster will attack and moving using serer side. What do you think about this?

What with attacks? It should be verify on monster server or simple calculations of positions (players and monsters)?

Maybe do you have other idea to do that. Maybe do you know some disadvantages of my idea?

Thanks for help

Tom

[GameMonetize]

This is a good idea and now you can easily leverage the nullEngine to have a fully working engine server side

[TomaszFurca]

Today i prepare first version of monster control by server. 

Let's see effect: https://streamable.com/urixt

left screen game, right screen server scene :).

Actually i work on problem with sync positions on client and server, also i found some problem with dispose mesh on NullEngine. I will write that on bugs forum.