game-networking

Game Networking

Overview

In a multiplayer game every client is running on a machine you do not control. Whatever a client can send, a cheater will send — teleports, infinite ammo, a hit on someone behind a wall, a purchase with money they do not have. The server (or host) owns the truth; clients send what the player wants to do and render what the server says happened, predicting locally so it still feels instant.

Core principle: Clients send inputs and intents, never outcomes. The authority validates every message before it changes state.

Pick the model the design needs (the repository has usually picked already)

Stacks: Unity — Netcode for GameObjects, Netcode for Entities, or the Mirror/FishNet/Photon the repo already uses; Unreal — built-in replication (Iris on newer projects that enabled it); Godot — high-level multiplayer (@rpc, MultiplayerSpawner, MultiplayerSynchronizer); web — Colyseus, or WebSocket/WebRTC servers; Bevy — lightyear, bevy_replicon, bevy_ggrs (rollback). Never add a second networking stack beside the one in use.

Validate on the authority — per engine

// Unreal: server RPC with validation; returning false from _Validate disconnects the caller
UFUNCTION(Server, Reliable, WithValidation)
void ServerFire(FVector_NetQuantize Origin, FVector_NetQuantizeNormal Direction, float ClientTime);

bool AShooterCharacter::ServerFire_Validate(FVector_NetQuantize Origin, FVector_NetQuantizeNormal Direction, float ClientTime) {
    return Direction.IsNormalized() && FMath::IsFinite(ClientTime);
}
void AShooterCharacter::ServerFire_Implementation(FVector_NetQuantize Origin, FVector_NetQuantizeNormal Direction, float ClientTime) {
    if (!Weapon->CanFire(GetWorld()->GetTimeSeconds())) return;                       // server's cooldown
    if (FVector::Dist(Origin, GetPawnViewLocation()) > MaxOriginError) return;        // origin near the server's view
    Weapon->FireServerAuthoritative(Origin, Direction);                               // server traces the hit
}