Securing Movement Logic Against Exploitation

Implement robust server-side checks to identify and reject invalid movement commands, such as speed hacking or unauthorized flight, in real-time.

In this lesson, you will learn how to implement server-side authority checks to validate movement data and reject illicit speed or position adjustments.

The Myth of Client-Side Trust

In a networked environment, the client’s CharacterMovementComponent is often responsible for predicting its own movement to ensure responsiveness. However, a malicious client can modify their local memory to bypass speed caps or ignore gravity. Since the server is the source of truth, it must treat every movement update from the client as a "request" rather than a "command."

Implementing Server-Side Validation

To secure your movement, you must calculate the maximum distance a character could realistically travel within a specific timeframe (DeltaTime) and compare it against the distance they claim to have traveled.

If a client sends an RPC to update their position (or if you are inspecting the SavedMoves during reconciliation), you should perform a "Sanity Check":

bool AMyCharacter::ValidateMovement(FVector ClientProposedLocation, float DeltaTime)
{
    float MaxSpeed = GetCharacterMovement()->GetMaxSpeed();
    float Tolerance = 1.15f; // Allowance for latency/jitter
    float MaxDistanceAllowed = MaxSpeed * DeltaTime * Tolerance;
    
    float DistanceSquared = FVector::DistSquared(GetActorLocation(), ClientProposedLocation);
    
    if (DistanceSquared > FMath::Square(MaxDistanceAllowed))
    {
        // Reject the movement and trigger reconciliation
        return false;
    }
    return true;
}

Enforcing Authority

When validation fails, you should not just ignore the move; you must force the client to synchronize with the server's authoritative state. By triggering a Server Reconciliation, you effectively snap the character back to the last known valid position. By maintaining a server-side timestamp of the last validated move, you can also identify "Teleport Hacks" where the player appears at a distant coordinate without a logical path of travel.

Always remember that validation logic must account for MovementModes—a player falling will have a different speed profile than one walking on ground. By verifying these constraints on the server, you neutralize exploits before they impact the integrity of your game world.

Key Takeaway: Never trust the client’s position data; always validate incoming movement against server-calculated constraints and force immediate reconciliation when discrepancies exceed your defined tolerance.