Implementing RPC Validation Functions for Security

Write dedicated validation functions to filter out malicious or malformed RPC requests before they execute on the server.

In this lesson, you will learn how to secure your server-side logic by implementing WithValidation functions to intercept and discard malicious or malformed Remote Procedure Call (RPC) requests.

The Security Gap

When you mark a function as Server in Unreal Engine, the client gains the ability to execute that code on the server. A common mistake is to assume that because the code runs on the server, it is inherently safe. However, a malicious user can modify their local game client or use tools to trigger your Server RPCs with arbitrary, illegal, or "impossible" data (e.g., passing a negative amount for healing or an invalid item index).

Implementing Validation

To prevent this, you must add the WithValidation keyword to your UFUNCTION macro. This instructs the engine to look for a corresponding function that returns a boolean. If this function returns false, the server ignores the RPC entirely, and the calling client is often flagged for a network error.

Consider a simple "Spend Currency" RPC:

// In your header file
UFUNCTION(Server, Reliable, WithValidation)
void Server_PurchaseItem(int32 ItemID);

// In your source file
bool Server_PurchaseItem_Validate(int32 ItemID)
{
    // Sanity check: Is the item ID within a valid range?
    if (ItemID < 0 || ItemID >= MaxItemCount)
    {
        return false; 
    }
    
    // Check game state logic: Does the player have enough gold?
    if (PlayerState->Gold < ItemCosts[ItemID])
    {
        return false;
    }

    return true; // Request is valid
}

void Server_PurchaseItem_Implementation(int32 ItemID)
{
    // Execution happens only if _Validate returns true
    PerformPurchaseLogic(ItemID);
}

Why This Matters

The _Validate function serves as your first line of defense. By enforcing strict checks here—such as validating indices, ensuring the player is currently in the correct state, or verifying that the distance between the player and an object is within reasonable bounds—you prevent hackers from manipulating the game state via network injection. Always treat data originating from a client as "dirty" and verify it before allowing any state-changing logic to proceed.

Key Takeaway: Never trust client-sent data; always use WithValidation to perform authoritative state checks before executing the logic inside your Server RPCs.