I'm working on a learning project of a fairly simplistic multiplayer RPG game as a way to get my head around best-practices etc.
One thing I am wondering is if best practice is to roll all loot drops and item crafting on the server rather than inside the game?
I don't have a lot of experience in game development so hopefully this doesn't seem like a really obvious / embarrassing yes or no! ?
My thought process was:
1. that if there are two players on a map, and they kill a mob, they need to immediately see identical loot, and;
2. rolling the properties of an item server-side eliminates the chance of hacking local code to spit out top tier items
If the above two assumptions are correct, my second question was how to verify on the server that the player has actually performed the function in-game? (For example, that the crafting materials were actually used, or the monster was actually killed? And that a forged request has not been sent from a modified game client?)
I would expect some sort of "signature" or unique hash to be included, but can't yet understand how that dynamic would work?