Wild-bird-feeder.com

Obviously, the users cannot be trustedUnder no circumstances can you assume that the users will not be able to defeat your cleverly-designed encryption scheme (if you use one), or your protocolsEverything the user sends to the server has to be validated

Most likely, on your server, you will have fixed buffersFor example, it is common to have a small (maybe 4K) buffer for the incoming data (from the sockets)A malicious user can send a really long data sequenceIf not checked, this will overflow the buffer, resulting in a server crash, or, worse, the user being able to hack your server, executing arbitrary codeEvery single message has to be checked: whether buffer overflow occurred, whether invalid data was sent (such as users sending "enter this door" even though the door is at the other end of the map, or "use the healing potion" although the user has no such potions, etc.)

I will say it again: It is extremely important to validate all the dataWhenever there is a violation, log it along with the username, IP, time and date, and the nature of the violationEvery once in a while, check that logIf you find few violations from many users, this is usually a bug in the client, or a network problemHowever, if you find a lot of violations from the same user or IP, this is a good indication that someone is toying with the server, trying either to hack it, or running a macro/scriptAlso, never store data on the client

The client should receive it's data from the serverIn other words, It should not send things such as: "Ok, this is my list of items" or "my strength is 10, my mana is 200, and my life is 2000 out of 2000"Also, the client should not receive more data than it needsFor example, the client should not know where other players are, except if they are nearby

This is common sense, since sending all the players to everyone will consume a lot of bandwidth, and some players might hack the client to give themselves unfair advantages (like having the position of certain player displayed on a map)All this seems common sense, but, again, you'd be surprised to find out how many people do not possess what we call common sense.

Other things to consider, when it comes to security: The player walk speed should be enforced on the server, not on the clientThe server should keep track of the time (in milliseconds) when a client last moved, and if a move request comes faster than the normal threshold, this request should be discardedDo not log such bogus requests, because they can result in network latency (i.ethe player lags, and all the data he sent in the last 10 seconds comes at once).

Check the DistanceIf a player attempts to trade with another player that is 10 billion kilometres away (or even on another map) log thatIf a player attempts to look at, or use a map object that is far away, log thatBe careful for bogus IDsFor example, it's normal to assign an ID to every player (the ID can be assigned when they log in, or it can be permanent (unique ID)If the ID is given when the player logs in (or when a monster is created), it makes sense to use the position (index) in the players array (where that player is) as the ID.

So the first player that logs in has ID 0, the second has ID 1, and so onNow, most likely you will have a limit of, say, 2000 indexes in that player listSo if a client sends a command such as: "look at actor with ID 200000" this will crash the server if unguarded since the server will attempt to access an invalid memorySo do a check such as: "if actor id<0 or if actor id> max players then log the violation and disconnect the player".

 If you program in C or C++, take care to either define the index as 'unsigned int' and check for the upper range, or if for some reason you define the index as int (int, by default is signed), remember to check against <0 and >max actorFailure to do so will result in a lot of frustration both for you and the other usersSimilarly, check for out-of-map coordinatesIf you have some form of path finding on your server, and the clients move by clicking on a position on the ground, make sure they do not click outside of the map.