Module 03 · Lesson 12

Who's in charge? Trust and authority

This is one of the most important lessons in the whole course. If this rule clicks, many FiveM security ideas stop feeling complicated. If it does not click, even a small script can become easy to exploit. The rule is short: the client asks, the server decides.

You'll learn: Who should decide what -> how to spot trust mistakes -> the basic request/response pattern used by safe features
Time: ~20 minutes
Prereqs: Lesson 10 (two worlds) and Lesson 11 (natives) complete.
Outcome: You can read a FiveM script and instantly spot where the server is trusting the client, and where it shouldn't.

BEFORE YOU START

Build it

Make the resource folder

The server has one folder for this lesson.

Inside your server's resources folder, create this folder:

code

resources/qu_trust_and_authority

Create the files

Every file named in the manifest exists.

Create this exact file layout:

code

resources/qu_trust_and_authority/
fxmanifest.lua
server.lua
client.lua

Who's in charge? Trust and authority

Build it

Make the resource folder

Create the files

Write fxmanifest.lua

Write the lesson code

Start and test it

Keep reading the full lesson