Colyseus: Is it possible to prevernt client side from creating rooms ?

[zgz682000]

I am writing a single room game server which creates room only by matckmaker api from server side. But some risks exists when someone access create room api from client side. Is it possible to prevernt client side from creating rooms ?

[endel]

Hi @zgz682000,

Currently, there is no API to prevent exposing the matchmaking methods for specific rooms. I think this would be an interesting addition, though. If you have any suggestion please let me know!

In the meantime, the workaround to prevent the client from manually creating them could be by validating a secret value during onCreate(), which only the server knows about. Example:

onCreate (options: any) {
    if (options.secret !== "MY-SECRET-VALUE") {
        throw new Error("unauthorized");
    }
}

[zgz682000]

Thank you for response. I will do as your example.
If I am asked to design this function, I will prefer to add a optional
argument which is a kind of new interface structre called RoomDefineOption to server.define method. I will use it like this:
gameServer.define('game_room', GameRoom, {forbidClientSideCreate: true});
Please forgive a new comer's ignorant advice.

[TeeTeeHaa]

The mentioned workaround might be abused by malicious clients for a denial-of-service attack because rooms will actually be created server-side, even while those rooms are unusable and immediately discarded.

The solution recommended by @zgz682000 is exactly what I would prefer to use for my own project (in which matchmaking and room-creation is done server-side in my own code, with plenty logic who is in which room already).

[thomasjonas]

I agree it would be great to have the option to disable client side room creation as well. As my server is running by nginx and I want disable creation for all rooms, I've just blocked the requests there by adding this to my nginx config:

location ~ /matchmake/(joinOrCreate|create) {
    deny all;
}

[endel]

While we still don't have an official solution for this, here's a nice workaround made by @TeeTeeHaa https://discuss.colyseus.io/topic/472/preventing-client-from-creating-rooms-on-the-server

const gameServer = new Server();
const tempServer = gameServer as any; // force access to private property by casting to any
tempServer.exposedMethods = []; // override property with empty array to not expose those methods anymore
gameServer.listen(port);