Unity network authorization
Validates Unity multiplayer actions where authoritative decisions belong. Checks identity, ownership, range and resource rules rather than accepting a client's claim that an attack or transfer is valid.
unity-network-authority-validation
Agents using this skill
When is it useful?
Use it when remote requests can change valuable state or ownership transfers must immediately remove earlier capabilities.
What does it help you do?
- Validates sender, ownership, membership and legal transition.
- Recomputes range, cooldown and resource claims at the authority.
- Separates private-state visibility from visual hiding.
Try asking this
Secure a Unity ability request against a modified client. Validate the sender's current character, target distance, cooldown and available energy on the authority. Repeat a stale request after ownership changes; it must be rejected without damage or resource changes, and hidden opponent data must not be sent merely because the UI hides it.
Detailed documentation
Read the skill’s original instructions, examples and checks in their authored language.
Show less
Multiplayer Authority Validation
Map trusted server/host and client responsibilities in the actual topology. Identify the authoritative owner of movement, inventory, combat, progression and spawning.
- Treat RPC/request payloads as untrusted. Validate sender identity, object ownership, session membership, target lifetime, legal state transition and permitted rate before applying an effect.
- Recompute or bound gameplay claims at the authority: distance, cooldown, resource cost, movement limits and damage eligibility. Client animation or a reported hit is not authorization by itself.
- Use supported serialization with size/count limits and reject malformed or stale requests safely. Define duplicate/sequence handling for operations that must happen once.
- Separate network visibility/interest from UI hiding; avoid sending private state to a participant merely because it is hidden visually.
- Handle ownership transfer and disconnect atomically according to the stack's lifecycle. A previous owner must not keep an effective capability after transfer.
- Keep credentials, join secrets and personal data out of diagnostic traces. Use existing platform/service authentication rather than inventing a credential scheme.
Check unauthorized sender, stale object, duplicate resource spend, excess rate, invalid state and late ownership transfer. Explain the exact enforced boundary and residual assumptions.
Reference: installed Netcode for GameObjects documentation. Network authority is a gameplay contract; never claim comprehensive anti-cheat from these checks alone.
Included files 2
LICENSE.txtSKILL.md