roblox-networking

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

roblox-networking

Core sources: https://create.roblox.com/docs/projects/client-server , https://create.roblox.com/docs/scripting/security/security-tactics (server-authority techniques), the entire scripting/security/ section (security-tactics, defensive-design, client-server-boundary, network-ownership, access-control, etc.), events/remote and bindable, plus the relevant Engine classes (RemoteEvent, RemoteFunction, Bindable*, RunService, etc.).

核心资料来源： https://create.roblox.com/docs/projects/client-server，https://create.roblox.com/docs/scripting/security/security-tactics（服务端权威技术），整个 scripting/security/ 章节（security-tactics、defensive-design、client-server-boundary、network-ownership、access-control 等），events/remote 和 bindable，以及相关 Engine 类（RemoteEvent、RemoteFunction、Bindable*、RunService 等）。

Authority boundary

权威边界

The server is authoritative for game state and simulation. The client simulates for responsiveness and renders what the server tells it. Anything that can be abused (economy, progression, combat outcomes, movement in competitive play) must be validated or simulated on the server.

服务端对游戏状态和模拟拥有权威。客户端负责模拟以保证响应速度，并渲染服务端告知的内容。任何可能被滥用的功能（经济系统、进度、战斗结果、竞技游戏中的移动）都必须在服务端进行验证或模拟。

Communication tools

通信工具

RemoteEvent. Fire-and-forget across the boundary.

Client → Server:
```
RemoteEvent:FireServer(...)
```
→ server handler receives
```
(player, ...)
```

Server → Client:

FireClient(player, ...)

FireAllClients(...)

RemoteFunction. Request/response (yields).

Client:

InvokeServer(...)

→ server

OnServerInvoke(player, ...)

Server can InvokeClient (less common, has caveats).

Critical warning:
RemoteFunction:InvokeClient
yields the server until the targeted client returns a value. A hostile or lagging client can leave the invocation pending and hang the server indefinitely. Avoid server→client invocation; if you must use it, enforce a timeout and treat the client as untrusted.

BindableEvent / BindableFunction. Same-side only (server modules talking to each other, or client modules). They stay on one side of the network boundary.

General rule: Client sends intent. Server decides outcome and replicates the result (or lets normal Instance replication handle it).

RemoteEvent。跨边界单向触发（fire-and-forget）。

客户端 → 服务端：
```
RemoteEvent:FireServer(...)
```
→ 服务端处理函数接收
```
(player, ...)
```

服务端 → 客户端：

FireClient(player, ...)

或

FireAllClients(...)

RemoteFunction。请求/响应（会产生等待）。

客户端：

InvokeServer(...)

→ 服务端

OnServerInvoke(player, ...)

服务端可以调用
```
InvokeClient
```
（不常用，并且存在注意事项）。

严重警告：
RemoteFunction:InvokeClient
会使服务端产生等待，直到目标客户端返回结果。恶意或延迟的客户端可能让调用一直处于挂起状态，导致服务端无限期阻塞。应避免由服务端调用客户端；如果必须使用，则应设置超时，并将客户端视为不可信来源。

BindableEvent / BindableFunction。仅限同侧使用（服务端模块之间或客户端模块之间通信），不会跨越网络边界。

通用规则：客户端发送意图，服务端决定结果并复制结果（或交由正常的 Instance 复制机制处理）。

Server authority techniques

服务端权威技术

Validate every client action (distance, rate, prerequisites, stamina, line-of-sight, etc.).
Simulate critical systems on the server (or at least re-execute the important parts).
Use server tables or Attributes as source of truth, not leaderstats or client-visible values.
For movement/physics in competitive games: rely on Roblox physics + network ownership + server validation/correction.
Replicate only what each client needs (don't broadcast entire inventories every frame).

See the official server-authority techniques page for movement validation, physics, etc.

验证每个客户端操作（距离、频率、前置条件、耐久度、视线等）。
在服务端模拟关键系统（或至少重新执行其中的重要部分）。
使用服务端表或 Attributes 作为事实来源，而不是 leaderstats 或客户端可见的值。
对于竞技游戏中的移动/物理系统：依赖 Roblox 物理、网络所有权以及服务端验证/修正。
仅复制每个客户端需要的内容（不要每帧广播整个背包）。

有关移动验证、物理等主题，请参阅官方的服务端权威技术页面。

Network ownership

网络所有权

Unanchored parts and assemblies have a network owner (usually the nearest player or the server, based on proximity and client capacity). The owner simulates the physics locally for low latency. Server can call

BasePart:SetNetworkOwner(player or nil)

to set ownership for the entire connected assembly. Anchored parts are always owned by the server and cannot be manually reassigned.

Critical for vehicles, projectiles, pushable objects, etc. Misuse leads to rubber-banding for other players or easy exploitation.

未锚定的部件和装配体具有网络所有者，通常根据距离和客户端容量由最近的玩家或服务端拥有。所有者会在本地模拟物理效果，以降低延迟。服务端可以调用

BasePart:SetNetworkOwner(player or nil)

，为整个连接的装配体设置所有权。锚定部件始终归服务端所有，无法手动重新分配。

网络所有权对于载具、投射物、可推动物体等尤其重要。错误使用会导致其他玩家看到橡皮筋效果，或为漏洞利用创造便利。

Common exploit classes and defenses

常见漏洞类型与防御

Speed/fly/noclip: server movement validation or physics ownership + correction.
Remote spam / duplication: per-player rate limiting + server-side cooldowns + argument validation.
LocalScript injection / free-model backdoors: audit assets, use capabilities, server validation.
Tampering with leaderstats or client-visible values: treat them as pure display; authoritative state lives in server tables or DataStores.
Information disclosure: don't parent secret models in replicated locations; use streaming, server-only storage (ServerStorage/ServerScriptService), and avoid putting sensitive geometry/triggers where clients can see them.
```
CanQuery
```
and collision groups are not confidentiality controls; they only affect spatial queries and physics collisions, not replication or rendering.

Rate limiting pattern (simple but effective): Keep a table of last action times per player per action type. On Remote, check delta. Warn or kick on abuse.

Capabilities (experimental security layer): Script capabilities let you restrict what scripts are allowed to do at a granular level. They are currently experimental. To use them, set

Workspace.SandboxedInstanceMode = Enum.SandboxedInstanceMode.Experimental

, then set

Sandboxed = true

and assign a

SecurityCapabilities

value on the script or a parent container (Model/Folder). This restricts the script to only the abilities in its capabilities set.

加速/飞行/穿墙：实施服务端移动验证，或结合物理所有权与修正机制。
Remote 刷屏/复制物品：按玩家进行速率限制，结合服务端冷却和参数验证。
LocalScript 注入/free-model 后门：审核资产，使用 capabilities，并执行服务端验证。
篡改 leaderstats 或客户端可见值：将它们视为纯展示数据；权威状态应保存在服务端表或 DataStore 中。
信息泄露：不要将机密模型放在可复制的位置；应使用 streaming、仅服务端存储（ServerStorage/ServerScriptService），并避免将敏感几何结构或触发器放在客户端可见的位置。
```
CanQuery
```
和碰撞组不是保密控制手段；它们只影响空间查询和物理碰撞，不影响复制或渲染。

速率限制模式（简单但有效）： 按玩家和操作类型保存最近一次操作时间。在 Remote 中检查时间差。发现滥用行为时发出警告或踢出玩家。

Capabilities（实验性安全层）： Script capabilities 允许以细粒度方式限制脚本能够执行的操作，目前仍处于实验阶段。要使用它，请先设置

Workspace.SandboxedInstanceMode = Enum.SandboxedInstanceMode.Experimental

，然后将脚本或其父容器（Model/Folder）的

Sandboxed

设置为

true

，并为其分配

SecurityCapabilities

值。这会将脚本限制为只能使用其 capabilities 集合中允许的能力。

Access control and confidentiality

访问控制与保密

What the client can see: control with Instance streaming, don't parent sensitive geometry in Workspace if clients shouldn't know the exact layout, use server-only containers where possible.
Confidential data (exact economy formulas, drop rates, anti-cheat parameters) should stay on the server.

客户端可以看到的内容：通过 Instance streaming 控制，不要将敏感几何结构放在客户端不应知晓确切布局的 Workspace 中，尽可能使用仅服务端容器。
机密数据（具体经济公式、掉落概率、反作弊参数）应保留在服务端。

Secure monetization and data flows (tie-in to other skills)

安全变现与数据流（与其他技能配合使用）

Prompt purchase on client.

For game passes: only grant benefits inside

PromptGamePassPurchaseFinished

when

wasPurchased == true

, and re-verify ownership with

UserOwnsGamePassAsync

PlayerAdded

For developer products and subscriptions: validate and grant benefits only inside the server-side
```
ProcessReceipt
```
callback.
DataStore writes only from server Scripts.
Any client Remote that says "I bought X, give me the item" must be ignored or treated as a hint and re-validated on the server.

在客户端发起购买提示。
对于游戏通行证：仅在
```
PromptGamePassPurchaseFinished
```
中
```
wasPurchased == true
```
时授予权益，并在
```
PlayerAdded
```
中通过
```
UserOwnsGamePassAsync
```
重新验证所有权。
对于开发者产品和订阅：仅在服务端
```
ProcessReceipt
```
回调中验证并授予权益。
DataStore 只能由服务端 Scripts 写入。
任何声称“我购买了 X，请给我物品”的客户端 Remote 都必须被忽略，或仅将其视为提示并在服务端重新验证。

Practical placement rules

实际放置规则

Authoritative logic, economy, progression, combat resolution, datastore access → ServerScriptService or server-only modules.
UI, input handling, cosmetic prediction, local VFX → client (LocalScripts or client modules under PlayerGui or required from ReplicatedStorage with IsClient branches).
Shared pure functions / constants / Remote definitions → ReplicatedStorage modules (loaded on both sides but executed in context).

Use

RunService

context checks everywhere you are unsure.

权威逻辑、经济系统、进度、战斗结算、DataStore 访问 → ServerScriptService 或仅服务端模块。
UI、输入处理、外观预测、本地 VFX → 客户端（LocalScripts，或位于 PlayerGui 下、从 ReplicatedStorage 引入并带有 IsClient 分支的客户端模块）。
共享的纯函数/常量/Remote 定义 → ReplicatedStorage 模块（两端均可加载，但按各自执行上下文运行）。

如果不确定应放在哪一侧，请 everywhere 使用

RunService

上下文检查。

Scripts

```
scripts/RateLimiter.lua
```
: a reviewed per-player/per-action limiter with a hard minimum interval, token capacity/refill, bounded action-key allocation, and denial reasons. Call
```
destroy()
```
on dedicated instances to disconnect cleanup;
```
RateLimiter.default
```
is the shared singleton.

```
scripts/RateLimiter.lua
```
：一个经过审查的按玩家/操作限流器，支持硬性最小间隔、token 容量/补充、有界操作键分配和拒绝原因。调用专用实例的
```
destroy()
```
以断开清理连接；
```
RateLimiter.default
```
是共享单例。

Reference index

参考索引

exploits-and-defenses.md: Review movement exploits, remote abuse, asset backdoors, or data exposure.
remote-and-bindable-patterns.md: Choose events versus functions or define communication payloads.
server-authority-and-validation.md: Validate remote arguments, enforce cooldowns, or review client prediction.

exploits-and-defenses.md：审查移动漏洞、Remote 滥用、资产后门或数据暴露问题。
remote-and-bindable-patterns.md：在事件与函数之间进行选择，或定义通信载荷。
server-authority-and-validation.md：验证 Remote 参数、执行冷却或审查客户端预测。