Handling Server-Side Validation of Movement States

Develop techniques to verify client-submitted movement data on the server to prevent cheating and ensure game world consistency.

In this lesson, you will learn how to enforce server-authoritative movement by validating incoming client data against your game world’s physical constraints to prevent cheating.

The Problem: Trusting the Client

In a networked environment, the client is responsible for sending its desired inputs (like move direction) to the server. However, if the server blindly trusts the client's reported position, a malicious player could modify their local memory to "teleport" or move at illegal speeds. To prevent this, the server must act as the ultimate judge of whether a movement state—specifically a location or velocity—is physically possible.

Implementing Server-Side Verification

The core technique involves the server receiving a client’s requested move, performing an independent calculation (or check), and comparing the result. If the client’s reported position deviates significantly from what the server calculates, the server rejects the movement and forces the client to snap back to the authorized position.

While CharacterMovementComponent handles much of this under the hood, custom movement logic requires manual verification. You typically perform this validation inside your Server_Move RPC:

void AMyCharacter::Server_Move_Implementation(FVector ClientRequestedLocation, float DeltaTime)
{
    // 1. Calculate the maximum distance allowed based on current velocity and delta time
    float MaxAllowedDistance = (CurrentMaxSpeed * DeltaTime) + Tolerance;
    
    // 2. Validate the distance from the last known server position
    if (FVector::DistSquared(ClientRequestedLocation, LastVerifiedLocation) > FMath::Square(MaxAllowedDistance))
    {
        // 3. Reject invalid state by forcing a correction
        Client_ForcePosition(LastVerifiedLocation);
    }
    else
    {
        // 4. Accept state if within tolerance
        LastVerifiedLocation = ClientRequestedLocation;
    }
}

Managing Tolerance

When validating, you must incorporate a Tolerance variable. Because of floating-point errors and minor packet jitter, a client’s calculated position will rarely match the server’s exact coordinate. By adding a small buffer to your distance check, you prevent "rubber-banding" caused by legitimate network latency or minor frame rate hitches, while still catching blatant speed hacks or teleportation cheats.

Key Takeaway: Never trust the client’s reported position; always validate movement data against the server’s authoritative simulation to maintain integrity and prevent exploitation.