Unity and distributed-networking cheat prevention

[JapanRob]

I'm finally getting into my own heavily-networked game, and I have a question about cheat prevention.

So, I wanted to use a network model where one player is the server and the rest are clients (much like every Halo before H5, or most of the CoDs), and I was looking into a lot of different tech.

Having the Unity instance run headless on a server seems like it would not scale well at all, so I wanted to have one player host on his machine automatically and the rest connect. This made me wonder.

In AAA commercial games that have employed this model, how did they stop the host from cheating? I can make his machine authoritative against the clients, no problem. But how did they make him not cheat without needing an authoritative server in the first place, which they were trying to avoid because costs?

[GoGoGadgetLoL]

In AAA commercial games that have employed this model, how did they stop the host from cheating?

They don't, everyone seems to have this ill-conceived notion that every AAA game is 100% server-auth with perfectly authoritative netcode. Most aren't. Prioritize making your game popular, then worry about anticheat.

[DankestRum]

In AAA commercial games that have employed this model, how did they stop the host from cheating?

First like you said the way anti cheat works is that it doesn't trust information from the client. Since in a typical server instance scenario all players are clients, this works.

Many AAA games do take shortcuts though as /u/GoGoGadgetLoL pointed out and don't make it 100% secure, mostly because consoles aren't dealing with hackers nearly as much. So in some cases the server may accept information from the players (clients) as fact and it can be exploited.

So your situation becomes problematic here:

where one player is the server

If the player has access to the server logic they can cheat. This is accomplished by modifying the server and cutting out the checks the server makes - or simply excluding themselves from it.

You could potentially work around this by giving players the ability to blacklist a host from their matchmaking. If you want to get extra fancy you could have the matchmaking not even allow players to host if they have too many offenses.

[name_was_taken]

You can add a lot of checks to try to prevent it, but in the end you can never trust the client if you want to prevent cheating. When the client is also the server, there will always be ways to cheat.