roblox-networking

---
name: roblox-networking
description: "Use when adding, changing, or auditing RemoteEvents/RemoteFunctions: argument validation, rate limits, server authority, exploit prevention."
when_to_use: "Also for anything sent between client and server, laggy or dropped events, desync, payload size, cooldowns, and security reviews of remotes."
last_reviewed: 2026-10-14
sources:
  - https://create.roblox.com/docs/scripting/events/remote
  - https://create.roblox.com/docs/scripting/security/security-tactics
  - https://create.roblox.com/docs/scripting/security/client-server-boundary
  - https://create.roblox.com/docs/projects/server-authority
  - https://create.roblox.com/docs/reference/engine/classes/UnreliableRemoteEvent
  - https://create.roblox.com/docs/reference/engine/classes/Workspace#GetServerTimeNow
  - https://1axen.github.io/blink/
  - original
---

# roblox networking

## When to Load

Load when adding a remote, handling untrusted input, adding cooldowns, or assigning authority.

## Quick Reference

- Every client argument is attacker-controlled; validate type, size, ownership, state, distance, cooldown on the server.
- Look up prices, damage, rewards, permissions from server-owned definitions.
- Choose the authority model first: Server Authority uses client prediction + server rollback, and is not `SetNetworkOwner`.
- Under Server Authority, simulation input uses `InputAction`/`BindToSimulation()` + `UseFixedSimulation`, not a remote.
- Events for most gameplay requests; keep `RemoteFunction` calls short and bounded.
- `RemoteEvent` for reliable state; not ordered vs property/attribute replication — one explicit channel or version state. `UnreliableRemoteEvent` only for replaceable data; droppable, 1000-byte cap.
- Engine ceiling: each remote type has ~500 FireServer req/s/client, pooled across same-type remotes — a ceiling, not a target.
- Measure payload and fire rate under load; budget rate × bytes × recipients; snapshot on join, diffs after.
- Hit timestamps are untrusted context, never proof. Bound freshness and validate server history; see full.md §3a.
- Typed schemas do not replace security checks. Pin generators and verify generated output in CI.
- Check NaN/infinity first (`x ~= x`, `math.abs(x) == math.huge`): `NaN` defeats `<`/`>`. `utf8.len` catches malformed UTF-8 that fails a DataStore save.
- Serialization: functions arrive `nil`, metatables stripped, mixed keys mangled, `nil` truncates tables, tables are copies — validate field by field, share state via server-owned snapshots/ids.
- Server Authority needs `AuthorityMode = Server` + its bundle; misprediction/rollback are normal (full.md).
- Rate limits protect the server; validation still rejects invalid requests. Bindables are same-side only: tables copied, metatables stripped, `Invoke` yields until `OnInvoke` returns.
- Record suspicion with thresholds; never punish one malformed packet.
- Edit-mode play: wrap the network layer so `RunContext:IsEdit()` gets a loopback mock (full.md).

**Need details?** `references/full.md` has validation, throttling, and mock patterns.