In a multiplayer game, the server should be the trusted referee. The client is important, but it runs on a device the player controls. A modified client can lie about damage, rewards, cooldowns, movement, inventory, or match results.
Think of client messages as requests
A safe backend treats client messages as requests, not facts. The client can say, "I want to buy this item," or "I hit this enemy," or "I finished the match." The server should ask, "Is that possible and allowed?"
This mindset is simple and powerful. The client can still feel fast and responsive, but the server owns the results that affect fairness, economy, and trust.
Validate rewards and currency
Rewards and currency should never be fully owned by the client. If the client can send "add 10,000 gems" and the server accepts it, attackers will find that quickly.
The server should know why a reward is given. Did the player complete a valid quest? Did the purchase receipt check out? Was the daily reward already claimed? Is the amount inside the expected range?
Validate movement and combat
Not every game needs perfect server-side physics, but basic sanity checks help a lot. Check movement speed, teleport distance, attack range, cooldowns, reload time, damage limits, and impossible state changes.
Be fair with these checks. Network lag, low frame rates, and bugs can create strange data. A single odd message may only need logging. Repeated impossible actions are more serious.
Validate cooldowns and time
Client clocks are easy to change. If crafting, energy, daily rewards, or cooldowns depend on the player's device time, cheaters can move time forward. The server should own trusted time for important systems.
Validate match results
Ranked matches, leaderboards, tournaments, and seasonal rewards need extra care. The server should check whether the match existed, who played, how long it lasted, what score was possible, and whether the result matches other signals.
Keep validation friendly
Server validation is not about making honest players feel watched. It is about keeping the game fair. Good validation blocks impossible actions, logs suspicious patterns, and gives support teams useful evidence when something goes wrong.
Do
- Validate rewards, currency, purchases, cooldowns, damage, movement limits, and match results on the server.
- Treat client messages as requests, not facts.
- Log rejected actions so you can tune rules and detect abuse patterns.
Don't
- Do not let the client decide final currency, rank, or inventory changes.
- Do not trust timestamps, scores, or cooldowns only because the client sent them.
- Do not punish every mismatch instantly without considering lag and bugs.