Server-authority checklist
Use this review before deploying a resource that receives client events or changes persistent state. The client can request an action; the server decides whether it is valid now.
Evidence to collect
- Every
RegisterNetEvent, callback, command, export, and NUI-to-client-to-server path - The data each handler trusts and the state it changes
- Permission, entity ownership, proximity, rate-limit, and audit requirements
- Tests for malformed, repeated, unauthorized, distant, and stale requests
Checklist
- Validate types, ranges, string lengths, table shape, and allowed identifiers.
- Derive player identity from
source; never accept a client-selected source or permission. - Re-read job, gang, inventory, money, and cooldown state on the server.
- Verify relevant entity existence, network ownership, coordinates, and plausible proximity.
- Rate-limit expensive or valuable actions per player and action.
- Keep database credentials, webhooks, license keys, and privileged tokens server-only.
- Log sensitive decisions without secrets or unnecessary personal data.
- Make rewards and charges idempotent where retries or duplicate events are possible.
Fix
Move authoritative checks and mutations into the server handler. Return only the minimum result the client needs, and reject invalid requests before performing database or economy work.
Rollback
Keep the previous reviewed resource commit deployable. If a security change breaks a flow, disable the affected action or restore that commit while preserving logs; do not remove validation globally.
Sources
Last updated on