Who's in charge? Trust and authority

This is one of the most important lessons in the whole course. If this rule clicks, many FiveM security ideas stop feeling complicated. If it does not click, even a small script can become easy to exploit. The rule is short: the client asks, the server decides.

You'll learn: Who should decide what -> how to spot trust mistakes -> the basic request/response pattern used by safe features
Time: ~20 minutes
Prereqs: Two worlds and natives complete.
Outcome: You can read a FiveM script and instantly spot where the server is trusting the client, and where it shouldn't.

BEFORE YOU START

Build it

Make the resource folder

The server has one folder for this lesson.

Inside your server's resources folder, create this folder:

code

resources/qu_trust_and_authority

Create the files

Every file named in the manifest exists.

Create this exact file layout:

code

resources/qu_trust_and_authority/
fxmanifest.lua
server.lua
client.lua

Write fxmanifest.lua

FiveM knows which files to load.

Open fxmanifest.lua and paste this:

code

fx_version 'cerulean'
game 'gta5'

client_script 'client.lua'
server_script 'server.lua'

There is no lua54 'yes' line here. As of June 2025 that directive is deprecated and ignored: Lua 5.4 is the only Lua runtime now, so you leave it out. This resource has a client file and a server file because the whole lesson is about the line between them.

Write the lesson code

The topic is now represented by runnable code.

Open server.lua and paste this:

code

RegisterNetEvent('qu_trust_and_authority:claim', function(clientAmount)
local src = source
print('[qu_trust_and_authority] player ' .. src .. ' asked for ' .. tostring(clientAmount) .. ', ignoring it')

local reward = 100
TriggerClientEvent('qu_trust_and_authority:paid', src, reward)
end)

Open client.lua and paste this:

code

RegisterCommand('claimreward', function()
TriggerServerEvent('qu_trust_and_authority:claim', 999999)
end, false)

RegisterNetEvent('qu_trust_and_authority:paid', function(amount)
print('[qu_trust_and_authority] server paid ' .. amount)
end)

Start and test it

The expected proof appears in the correct console.

Open server.cfg and add this line:

code

ensure qu_trust_and_authority

Save. Because this folder is brand new, the server has not indexed it yet, so you cannot restart it directly. In your server console (the FXServer window, or the txAdmin Live Console), run these two commands in order:

code

refresh
ensure qu_trust_and_authority

refresh makes the server scan the resources folder and discover the new files. ensure then starts the resource. After this first start, editing the code and running restart qu_trust_and_authority will work for reloads.

Join the server, then run this in the chat box (press T):

code

/claimreward

The first line prints in your server console (the FXServer window or the txAdmin Live Console). The second line prints in the FiveM client F8 console on your own machine (open it in-game by pressing F8):

Keep reading the full lesson

Still ahead in this lesson

How it works
If something went wrong
What you can do now
Try it yourself