Skip to main content

Security Model

Nord Doorlock treats the server as authoritative for security-sensitive door actions.

Server-Side Validation

Normal player toggle requests are validated for:

  • Door existence
  • Rate limiting
  • Player proximity
  • Door access rules
  • Authorization hooks

Lockpick requests add inventory and lockpick-enabled validation.

Distance Validation

Config.ServerDistanceCheck = true
Config.ServerDistanceTolerance = 2.0

Keep ServerDistanceCheck enabled on production servers unless you have a specific architecture that replaces it.

Rate Limiting

Config.RateLimitMs = 350

This limits repeated interaction requests from a source.

Client Exports

Functions such as:

RequestToggle
RequestLockpick
OpenAdmin

are requests, not privileged direct state changes.

The server validates them.

Server Exports

Server exports can perform authoritative state changes because server resources are considered trusted code.

Do not expose unrestricted server events in your own resource that directly forward arbitrary player input into:

CreateDoor
UpdateDoor
DeleteDoor
LockDoor
UnlockDoor

without your own authorization.

Admin Panel

Opening the panel is validated server-side using the configured administrator ACE and framework groups.

Persistence

Authoritative state changes are persisted before clients are told the change succeeded.

When persistence fails, Nord Doorlock attempts to restore the previous in-memory state.

Hooks

Authorization hooks execute server-side.

Only register trusted server callbacks.

Inventory Bridge

If lockpick item ownership matters, make sure your selected inventory bridge performs a real server-side item check.

The standalone fallback should be customized for servers with a custom inventory.

Back to top