> In my experience game engines just suck. How can cheats exist in a server authoritative game engine architecture? But alas, most programmers have apparently no idea what they're doing when it comes to "netcode".
This comment screams: I lack understanding and am overconfident because of it.
Ignoring games where all state is known to all parties (e.g. chess, racing, etc...), the fact of the matter is that servers are basically always authoritative... where they can be.
MOBAs, MMOs, RTSs, FPSs, Casino, etc... will all hide information not required to run the game on each client on the server to prevent cheaters from getting an advantage.
Turn based games or games with low tick rates (MMOs, MOBAs, RTSs) will run all player commands on the server with things that require immediate feedback (UI actions, current player position, animation triggers) smeared out to sync with the server's state and tweened to match the server state.
Fast paced games like racing sims will do client side determination with server side validation (to ensure that a player's speed never exceeds a certain value, turn speed/friction is inside a certain range, etc...).
FPS games are the trickiest:
- They can't do server side kill determination because the game requires a certain level of responsiveness that is faster than internet signals over fiber can allow for. So they use client-side kill determination that runs in real time with server side validation that runs when a server receives events from clients before passing those events to other players. For example: checking that a player didn't shoot another player through a wall, checking that another player wasn't moving too fast / through a wall / flying through the sky / etc...
- Components that require randomness are split into what requires syncing between client/server and what doesn't. Things like particle systems, ragdolls, etc... are handled entirely on the client. Things like random rolls in stores are handled entirely on the server. Things like physics systems, and recoil are handled by seeded PRNGs that are run on the client for instant feedback and validated on the server side using that seed.
- Depending on the type of FPS game, a client may need to see the positions of all (or a substantial amount) of the other player's characters. This is because a player may suddenly whip around the corner of a door and the client now seeing a new large area needs to be able to display the other characters in that area accurately without the characters only rendering by the time the server can inform the client of their position. This is mitigated by level design that can split a level into multiple chunks and the server only relaying the required info for the visible chunks. With extremely large levels where the groups of players are too far away to interact, the server can be sharded across multiple threads or offloaded to other servers. For types of FPS games that are built in a way that requires the server to not hold as much information hidden (e.g. an open arena level where everyone can see each-other anyway), the clients include replay systems where the players can report suspicious behavior.
- Really tricky things like vehicle physics are usually done with a mix of client side determination, server side validation + redetermination, and careful client side state tweening.
The fact of the matter is that cheaters are only a problem in:
1. A handful of games where the developers didn't do the right thing
2. Games where the only way they could ever be completely cheat-free would be on a physically impossible 0 latency network and instead they have to rely on mitigation instead of prevention where certain information can't be prevented from being available to clients.
----------------------------------------
Addendum: There is the possibility of hosting and processing hidden information client-side while keeping it hidden where needed by using homomorphic encryption but that requires a lot of processing power that's usually better spent on running the rest of the actual game, but it is something that more of the industry will be able to move towards as machines become more powerful.