In this lesson, you will learn how to enforce server-authoritative control by configuring granular read and write permissions for your NetworkVariable instances.
In multiplayer environments, trusting the client is a primary security vulnerability. If a player’s client can write to their own Health or Experience points, they can easily inject malicious values to gain an unfair advantage. To prevent this, we use the NetworkVariable constructor to define exactly who is allowed to read and, more importantly, who is allowed to write to specific variables.
Defining Permissions
When you declare a NetworkVariable, you provide two permission parameters: readPerm and writePerm. For sensitive data, you should almost always set the writePerm to NetworkVariableWritePermission.Server.
By setting the write permission to Server, you ensure that even if a client attempts to modify the variable locally, the change will be rejected or ignored by the authoritative server, effectively neutralizing "memory editing" cheats for that variable.
Consider this example for a player’s gold count:
public class PlayerEconomy : NetworkBehaviour
{
// Only the server can modify this, but all clients can read it.
private NetworkVariable<int> goldCount = new NetworkVariable<int>(
0,
NetworkVariableReadPermission.Everyone,
NetworkVariableWritePermission.Server
);
public void AddGold(int amount)
{
if (IsServer)
{
goldCount.Value += amount;
}
}
}
Why This Matters
If you mistakenly set writePerm to Owner, the player's client has direct control over that variable. While this is acceptable for cosmetic settings (like a custom player color), it is catastrophic for gameplay-impacting stats. By defaulting to Server writes, you force all logic changes to pass through your authoritative server code, where you can perform validation checks (e.g., checking if the player actually killed an enemy before granting the gold) before applying the value.
Always design your network state with the "Zero Trust" mindset: if the client doesn't need to write to it, lock it down to the server.
Key Takeaway: Always restrict NetworkVariableWritePermission to Server for any data that affects game balance or progression to prevent unauthorized client-side manipulation.