[Release][DEV] Server Event Security Tokens - Anticheat

No worries. All good discussion.

Yes, that would be possible. I have thought about that as well: having the server deploy scripts on client load. If I get a stable solution for it, I’ll share. I actually think it would be relatively easy to do, but fear that someone could just create their own listener and still get the script. It could be implemented in a similar way to this tokenizer resource to generate unique events everytime a player joins to attempt to mitigate that.

Ultimately, it’s best to do everything you can server side. Obviously you can’t do UI, etc. server side, but lots of logic can be easily offloaded to the server and protect it. That reduces performance hits on the client while also protecting your scripts from being stolen and from being exploited.

This resource looks pretty solid for syncing data between the client and the server. It could be a good start to syncing scripts.

when i revive player. i get banned. because of invalid token. i event dont use for ambulance script.

Then whatever the ambulance job is triggering isn’t inside of the ambulance job resource. Turn on verbose server logging and you’ll see the impacted resource.

1 Like

So now practically, there would be no way for a cheater with serious intents of cheating, of bypassing this? after all these changes

If implemented correctly, a cheater cannot trigger server events.

So, what your saying is, there is absolutely no way for a cheater to trigger events using a LUA injector? (accept magically guessing the tokens)

They cannot trigger SERVER events without somehow guessing a 24 character string. They can still trigger CLIENT events.

so es_admin’s ban event would be a server event right?

I would imagine so. I don’t use es_admin, but that should be server side.

great to finally see a full proof solution to lua injectors on FiveM. Great work Salty :slight_smile:

does this also work for Vmenu, since it is written in c#? (apparently a cache decrypter picks up c# server events which can apparently be triggered by the lua injector)

You should be able to use Lua exports in C#. It will require modifying vMenu. I don’t think that’s needed since vMenu allows you to configure permissions. But I don’t use it so I don’t know for sure.

1 Like

Working?

Sure is.

Is it like this?


Can i do it like that

Yes, but your client side will need to trigger the event with a token as well. And you need to add the init.lua to your __resource.lua file. But in general, you are correct, yes.

So both of them can be same but i just ne to rename the NetEvent

So this is the right way?



Yes, that all looks correct. Turn on VerboseServer in config to verify it’s validating it.

Like that?
image