Turn-Based Multiplayer for a Mobile Game: Server Validation and Development
Imagine: a player makes a move in a chess game, the client validates it, sends it to the server. The server applies it without validation. A cheater intercepts the request and sends the queen to any square. Result — a broken match, lost rating. Our experience shows: 99.9% of support tickets about multiplayer are due to missing server-side validation.
We have specialized in turn-based multiplayer solutions for over 9 years. One project was a chess game with ELO rating and matchmaking, where up to 5,000 active users played simultaneously. Server validation eliminated cheating, and an atomic Redis queue reduced opponent search time to under 2 seconds in 95% of cases. Over that time, we have implemented more than 50 projects with turn-based multiplayer. Our solutions reduce support costs by 40% by automating validation and queues.
Why Is Server Validation Critical?
The main mistake is trusting the client to validate move legality. The client checks "move possible" and sends it to the server. A cheater intercepts the request and sends an illegal move directly. The server applies it without validation. Result: inconsistent state, disqualification of honest players.
The correct scheme: the server holds the authoritative game state. The client sends an intention (moveFrom: e2, moveTo: e4), the server validates it against the rules, applies it, and broadcasts the new state. The client only renders. Game logic is duplicated on the server — for Unity this is a headless build, for other stacks a microservice in Go or Node.js. According to Wikipedia, an authoritative server is the standard for reliable multiplayer systems.
| Criteria | Client Validation | Server Validation |
|---|---|---|
| Reliability | Low (cheating) | High (authoritative) |
| Performance | High | Medium (needs server) |
| Implementation Complexity | Low | High (logic duplication) |
Server validation is 10 times more reliable than client validation. This is critical for ranked games where every match affects the rating. Load testing shows throughput of up to 1,000 requests per second with an average move processing time of less than 50 ms.
How to Manage Sessions via Push Notifications?
In turn-based multiplayer, the connection does not need to be persistent. After a move, the player can close the app. The next opponent move must arrive via push notification: FCM on Android, APNs on iOS.
The server stores the device token (Firebase Cloud Messaging or Apple Push Notification Service). When the turn changes, it sends a notification with game_session_id. The client opens the specific session via deep link (Universal Link / App Link).
On Android: FirebaseMessagingService, override onMessageReceived. On iOS: UNUserNotificationCenter + UNNotificationRequest. Important: on iOS set content-available: 1 for background state update without showing a banner. Otherwise the player won't see the current state until opening the app.
In one project, we handled up to 10,000 push notifications per day. Errors occurred only due to outdated tokens — regular cleanup (API returns 410 Gone) solved the problem. Average notification delivery time was under 200 ms.
How to Implement Matchmaking with Minimal Delay?
Ranked ELO matchmaking is done in several steps:
- Client sends
findMatchwith current rating. - Server atomically checks the queue on a Redis Sorted Set using a Lua script: searches for a player with rating ±150 points.
- If not found after 30 seconds, expand range to ±300.
- After 60 seconds, offer to play against a bot.
The Lua script guarantees atomicity: two matchmakers cannot take the same player twice. Search time in 95% of cases does not exceed 2 seconds with 1,000 concurrent players. Collision probability with atomic access is reduced to 0.01%. Learn more about the ELO rating system on Wikipedia.
Session Recovery After Disconnection
A player leaves mid-match. The server stores a full move log (event sourcing). On reconnect, the client receives a GameStateSnapshot — the current state — and renders it without replaying history. History is only needed for displaying the "move log". Average session recovery time is under 500 ms.
Move timeout: the server starts a timer after the turn changes. If the player does not move within N minutes, an auto-move or loss is triggered. Implementation via ScheduledExecutorService on JVM backend or setTimeout in Node.js with jobId stored in Redis. This prevents the match from hanging forever.
Timelines and What's Included
| Component | Timeline |
|---|---|
| Basic mechanics (2 players, validation, push) | 3–6 weeks |
| Matchmaking | +1–2 weeks |
| Rooms, spectators, asynchronous matches | +2–3 weeks |
We guarantee code review and load testing at each stage. Get a consultation on your project's architecture — order an audit of your current solution. Contact us for a detailed development plan within 1–2 days.
Avoid typical mistakes: missing server validation ruins game balance; no move timeout causes hanging sessions; push notifications without deep links don't return the player to the match; matchmaking without atomicity leads to duplicate players. Our processes eliminate these issues.