Advanced Simulator Authority

Some games require enhanced security against cheating or player griefing. This is done by giving different authoritative privileges only to simulators.

Configuring for cloud hosted Replication Server

In the Project Settings section of the Online Dashboard under Advanced Authority Config, you can select which Host Authority features are enabled for rooms and worlds separately, under Rooms Host Authority and Worlds Host Authority.

Configuring for local development

In the coherence project settings, under Local Replication Server, you can select which Host Authority features are enabled for locally run Replication Server world. Or in case you are manually launching the Replication Server from the CLI then the --host-authority-features parameter should be passed into the command where each features' value is added to the passed in value.

Eg:

replication-server worlds --host-authority-features=7

Where the values of the features are:

• Create Entities = 1

• Validate Connections = 2

To select which Host Authority features are enabled for locally run room, you need to set SelfHostedRoomCreationOptions.HostAuthority at room creation time.

If any host authority feature is enabled, the Replication Server will not allow clients to be connected without a simulator being connected as well.

If a client tries to connect before a simulator, the connection will be denied with the ConnectionCloseReason.HostNotReady.

If a simulator disconnects, while other clients are connected to the server, the Replication Server will forcefully disconnect all other clients as well with the ConnectionCloseReason.HostDisconnected.

Restricting Creating Entities

The HostAuthority.CreateEntities feature is used to only allow simulators to create entities. Once created, these entities can have their state authority transferred and the lifetime managed by non-simulators, but no client is allowed to create entities when this restriction is active.

By default, all CoherenceSyncs have AuthorityTransferType set to Steal. This means that malicious players could steal the authority of any entity and break the game.

Instead of manually changing the AuthorityTransferType on every new CoherenceSync, you can change the default value of it in the coherence project settings.

Disabling global query for client connections on the Coherence Bridge

By default, when client connections are active, the Coherence Bridge will automatically create a global query entity on behalf of the client. If the client is not authorized to create entities then this results in an error on the Replication Server indicating that an entity creation was rejected. To avoid these error logs, the auto creation of the global query can be disabled in the Coherence Bridge configuration:

Uncheck the Create Global Query option

A global query can be created manually as part of a prefab by using the CoherenceGlobalQuery component. This prefab can then be transferred to other clients from the simulator to give those clients access to the global client connections.

Validating Client Connections

The HostAuthority.ValidateConnection feature is used to restrict who can connect to the world or a room. Enabling this feature, on every connection attempt from a client, the connected simulator will receive a validation request, and only if the simulator responds with the accepted validation response will the connection be allowed.

To handle the connection validation requests, the simulator has to subscribe to the CoherenceBridge.onValidateConnectionRequest event and invoke the given respond delegate with the validation result:

bridge.onValidateConnectionRequest.AddListener((clientID, userPayload, respond) => {
    bool accept = Validate(clientID, userPayload); // your own validation logic
    respond(accept); // this can even be called asynchronously
});

If the simulator rejects the connection, the client will receive a connection denied error with the ConnectionCloseReason.ConnectionRejectedByHost.

Custom user payload

Before initiating the connection, the user can set an optional custom user payload which will be sent to the simulator for validation. The payload is of type byte[], and contain a token, any other content or can even be null. To send the payload for validation, you must set it before initiating the connection:

var payload = Encoding.ASCII.GetBytes(myToken);
bridge.SetConnectionValidationPayload(payload);
bridge.JoinRoom(...); // or bridge.Connect(...);

Kicking Client Connections

A simulator can forcefully disconnect other clients by kicking them. When kicking the client, the simulator can also send an optional user payload of type byte[] which will be sent to the kicked client, together with the ConnectionCloseReason.KickedByHost.

// On simulator
var payload = Encoding.ASCII.GetBytes("Kicked for griefing.");
bridge.KickConnection(clientID, payload);

// On client
bridge.onConnectionError.AddListener((bridge, exception) => 
{
    if (exception is ConnectionDeniedException deniedException &&
        deniedException.CloseReason == ConnectionCloseReason.KickedByHost) 
    {
        var message = Encoding.ASCII.GetString(deniedException.UserPayload);
        Debug.Log($"Kicked with message: {message}");
    }
});