Through my testing, it doesn't appear that the client is able to change the contents of a module script in replicated storage across other clients or the server. They are not able to change data that has been required by module scripts either. For example:
Module Script in Replicated Storage:
local module = {}
module.count = 0
function module.increment()
module.count = module.count + 1
end
return module
Local Script in StarterPlayerScripts:
local module = require(game:GetService("ReplicatedStorage"):WaitForChild("ModuleScript"))
module.increment()
print(module.count) --outputs 1
Script in ServerScripts:
local module = require(game:GetService("ReplicatedStorage").ModuleScript)
wait(5) --local script calls module.increment
print(module.count) --outputs 0
So long as filtering is enabled, that behaviour takes place. My question is are there any security risks I should be aware of that I'm missing for shared module scripts across the server and the client? Would this behaviour change if the client requires the module script before the server?
2 comments
local script can't change the contents of the module script on the server, but they can change the contents on the client. this is because when requiring a module script, the server will have their own copy while the client will have their own copy. the client can't change the server's copy but they can change their local copy. you can test this by printing out the module that you require() and yo
Right. As long as I don't delegate any responsibilities to the client then my game is secure.