In this lesson, you will learn how to enforce server-side validation on incoming variable updates to prevent malicious clients from injecting invalid game states.
The Trust-No-Client Principle
In Unreal Engine networking, you must always treat data arriving from a client as "untrusted." While you might be tempted to use a simple Server RPC to set a variable like PlayerHealth or ExperiencePoints, a clever player could modify their game client to send a value of 999,999 to the server. Simply replicating a variable is not enough; you must establish a "gatekeeper" logic that inspects the data before it becomes the authoritative state.
Implementing Server-Side Validation
Instead of allowing direct modification of sensitive variables, you should wrap your logic in a validation function that acts as a circuit breaker. If the incoming value fails your integrity checks, you reject the change entirely or clamp it to a safe value.
Consider this pattern for updating an attribute:
void AMyCharacter::Server_UpdateExperience_Implementation(int32 NewXP)
{
// Integrity Check: Ensure the player isn't granting themselves impossible amounts
const int32 MaxXPChange = 100;
if (NewXP - CurrentExperience <= MaxXPChange)
{
CurrentExperience = NewXP;
}
else
{
// Log the event for anti-cheat and ignore the update
UE_LOG(LogGame, Warning, TEXT("Integrity Violation: Potential XP hack detected!"));
}
}
Why RepNotify Isn't Always Enough
While RepNotify is excellent for triggering visual updates on clients, it runs after the variable has been set on the server. If your replication source is a raw variable that the client has ownership of, the data is already compromised by the time the OnRep function executes.
To ensure true integrity, keep your sensitive variables marked as Replicated but private in your C++ header. Provide public methods that require the client to request a change via an RPC, where the server performs the validation before modifying the variable. This approach ensures that the server—and only the server—remains the source of truth, regardless of what the client tries to dictate.
Key Takeaway: Never assume incoming replicated data is valid; always perform authoritative server-side validation before committing changes to your game state.