How trusted is the client?

FiveM Discussion
1

I see that CreateVehicle is a client-only function vs. the same being server-only in MTA. Just how trusted is the client when it comes to networking? Can people just spawn stuff with the server having no choice but to accept it? Wouldn’t this lead to rampant cheating?

2

Typically when you spawn a vehicle. You use this

CreateVehicle(carName, x + 3, y + 3, z + 1, GetEntityHeading(GetPlayerPed(-1)), true, false)

This is taken from the Cfx.re Docs site.

-- CREATE_VEHICLE
local retval --[[ Vehicle ]] =
	CreateVehicle(
		modelHash --[[ Hash ]], 
		x --[[ number ]], 
		y --[[ number ]], 
		z --[[ number ]], 
		heading --[[ number ]], 
		isNetwork --[[ boolean ]], 
		netMissionEntity --[[ boolean ]]

The main parameter being “isNetwork”. What this does is this, again taken from the Cfx.re Docs site.

  • isNetwork: Whether to create a network object for the vehicle. If false, the vehicle exists only locally.

So the person who created the menu to spawn vehicles, would tell the server(or network) that this vehicle needs to exist for everyone.

FiveM is also separate from the standard GTA 5 Servers. So we have no need to spawn money in, as we play on servers we enjoy. Cash is not an issue on FiveM, because 9 times out of 10 you spawn it in, or earn it from the community made servers.

In regards to anyone spawning. There’s also a permission system. So you can set up who can access the commands/menu’s to spawn anything they want :slight_smile:

Hope that answered your question.

3

You can totally not trust the client, however with OneSync you can filter/ratelimit entities spawn by the client using the entityCreating event

1 Like
4

Unless you enable entity lockdown or do other filtering, yes. However, if you don’t rely on badly written public code it’s easy to just spawn stuff server-side - the creation function does exist on server albeit with a different hash since it’s not the game’s implementation.

5

That sounds nice but another thing the docs aren’t that much done yet so is there another source that people including me can use for checking what you can use in server

6
7

Thank you and sorry for asking this is probably stupid but what does rpc stands for and if you have the time to answer you can’t join servers from a FiveM that is manually build for security reasons right the error is that the client doesn’t has a authentication ticket and by the code it seems that it searches for a cfxTicket in the postMap variable on connection to the server and ty again really love FiveM and the community wish you all the best keep up the good work!