The Authoritative Server
Manja Arena is an online kite-fighting game. Up to 16 players steer kites above a rooftop arena, and when two strings cross, the player pulling harder cuts the other kite loose. Each match runs on a server in a Mumbai data centre. Before you write any network code, one question shapes everything that follows: whose computer gets to say what really happened?
The rule
Clients send what the player wants; the server decides what happens.
In an authoritative server design, the server holds the only true copy of the match: every kite's position, every string, every score. Each player's copy of the game, the client, is a window onto that world plus a set of controls.
- Clients send intentions. "Steer left." "Pull the string." Never "my kite is now at x = 410" or "I cut kite 3".
- The server simulates. It applies each player's inputs to its own world, moves the kites and checks which strings crossed.
- The server announces results. It tells every client where the kites are and which kite was cut.
Rejected client → server: "kite 7 is at (410, 220), and it cut kite 3"
Accepted client → server: "tick 1042: steer left, pull"
Broadcast server → all: "tick 1042: kite 3 was cut by kite 7"Why so strict? The client runs on the player's own machine, and anything on that machine can be changed: memory editors, modified game files, scripts that forge network messages. If the server believed a client's claims, one cheater could teleport, never lose a kite, or hand themselves coins. When a client can only ask, the worst a modified client can do is ask for things the rules already allow, and the server checks even that. An input arriving 300 times a second, when the game accepts one per tick, is itself a red flag.
Some things can stay on the client because they affect nobody else: the camera angle, the sound volume, particle effects, which menu is open.
There are other designs. Each client could own its own kite, or players' machines could talk directly to each other with no server at all. Both save server costs, and both hand trust to machines you do not control.
The shortcut
For any piece of game data, ask one question: "If a cheater changed this, would another player lose something?" Yes means the server owns it, and the client may only send an input. No means the client may keep it.
Name the data
"Kite 3 was cut by kite 7." It changes the score and removes a player from the round.
The usual trap is trusting the client "just for this one thing": a hit, a coin reward, a finish time. Each of those becomes the first cheat anyone writes.
Drills
Answer fast — trust the rule.
A Manja Arena player presses the left arrow key. What does their client send to the server?
Which of these can safely stay under the client's control?
The server accepts one input per player per tick at 20 ticks a second. One client sends 300 "pull" inputs in a second. What should the server do?
A cheater edits their client so their kite moves twice as fast. Why does this fail against an authoritative server?
Remember
- Clients send what the player wants; the server decides what happens.
- Shortcut: "If a cheater changed this, would another player lose something?" Yes means the server owns it.
- Trap: trusting the client "just once" for hits, rewards or positions.