Please enable JavaScript to view the comments powered by Disqus.

Part 2: Multiplayer Game Tutorial: Authorative Server, P2 physics in the server.

Making client dumb. Make server authorative.


Repository available here:

This is a continuation of the multiplayer game tutorial series with Phaser in the client and Node.js in the server. In the first part

-We successfully set up the developing environment.
-We connected the clients and the server with and Express.js.
-We synced all client movements so that the server has one game state.

However, remember that our implementation is very naive because we’re sending our client position directly to the server, and we are broadcasting that position back to the rest of the connected players.

Why is this dangerous? Mainly because client side is easily manipulatable. Moreover, anyone can change javascript files, meaning that a hacker can easily manipulate their position in the game through changing our javascript file, which will harm the game experience of all the other players.

What’s a solution then? We can make our game “Server Authoritative”. This means that all the important data is stored and calculated in the server. We can make our game more secure by sending inputs to the server instead of the position. And then, we can calculate the new position of the player and broadcast it to other players. However, there is one problem. Note that we are using physics for following mouse pointers. It’s not as simple as pressing the arrow keys to move the player. This means that we need a physics system in the server as well!.

For the physics in the server, we will use p2 physics. The fact that we are using p2 physics in the client is a cherry on the top since the client and server calculation will be similar.

To install p2 physics, type npm install p2 --save

You're ready to code now

Client Side: main.js

var socket; 
socket = io.connect();

canvas_width = window.innerWidth * window.devicePixelRatio;
canvas_height = window.innerHeight * window.devicePixelRatio;

game = new Phaser.Game(canvas_width,canvas_height, Phaser.CANVAS, 'gameDiv');

//the enemy player list 
var enemies = [];

var gameProperties = { 
	gameWidth: 4000,
	gameHeight: 4000,
	game_elemnt: "gameDiv",
	in_game: false,

var main = function(game){

function onsocketConnected () {
	console.log("connected to server"); 
	gameProperties.in_game = true;
	// send the server our initial position and tell it we are connected
	socket.emit('new_player', {x: 0, y: 0, angle: 0});

// When the server notifies us of client disconnection, we find the disconnected
// enemy and remove from our game
function onRemovePlayer (data) {
	var removePlayer = findplayerbyid(;
	// Player not found
	if (!removePlayer) {
		console.log('Player not found: ',
	enemies.splice(enemies.indexOf(removePlayer), 1);

function createPlayer () {
	player =, 0);
	player.radius = 100;

	// set a fill and line style
	player.lineStyle(2, 0xffd900, 1);
	player.drawCircle(0, 0, player.radius * 2);
	player.body_size = player.radius; 

	// draw a shape
	game.physics.p2.enableBody(player, true);
	player.body.addCircle(player.body_size, 0 , 0);[0].sensor = true;

// this is the enemy class. 
var remote_player = function (id, startx, starty, start_angle) {
	this.x = startx;
	this.y = starty;
	//this is the unique socket id. We use it as a unique name for enemy = id;
	this.angle = start_angle;
	this.player = , this.y);
	this.player.radius = 100;

	// set a fill and line style
	this.player.lineStyle(2, 0xffd900, 1);
	this.player.drawCircle(0, 0, this.player.radius * 2);
	this.player.body_size = this.player.radius; 

	// draw a shape
	game.physics.p2.enableBody(this.player, true);
	this.player.body.addCircle(this.player.body_size, 0 , 0);[0].sensor = true;

//Server will tell us when a new enemy player connects to the server.
//We create a new enemy in our game.
function onNewPlayer (data) {
	//enemy object 
	var new_enemy = new remote_player(, data.x, data.y, data.angle); 

//Server tells us there is a new enemy movement. We find the moved enemy
//and sync the enemy movement with the server
function onEnemyMove (data) {
	console.log("moving enemy");
	var movePlayer = findplayerbyid (; 
	if (!movePlayer) {
	var newPointer = {
		x: data.x,
		y: data.y, 
		worldX: data.x,
		worldY: data.y, 
	var distance = distanceToPointer(movePlayer.player, newPointer);
	speed = distance/0.05;
	movePlayer.rotation = movetoPointer(movePlayer.player, speed, newPointer);

//we're receiving the calculated position from the server and changing the player position
function onInputRecieved (data) {
	//we're forming a new pointer with the new position
	var newPointer = {
		x: data.x,
		y: data.y, 
		worldX: data.x,
		worldY: data.y, 
	var distance = distanceToPointer(player, newPointer);
	//we're receiving player position every 50ms. We're interpolating 
	//between the current position and the new position so that player
	//does jerk. 
	speed = distance/0.05;
	//move to the new position. 
	player.rotation = movetoPointer(player, speed, newPointer);


//This is where we use the socket id. 
//Search through enemies list to find the right enemy of the id.
function findplayerbyid (id) {
	for (var i = 0; i < enemies.length; i++) {
		if (enemies[i].id == id) {
			return enemies[i]; 

main.prototype = {
	preload: function() {
		game.stage.disableVisibilityChange = true;
		game.scale.scaleMode = Phaser.ScaleManager.RESIZE;, 0, gameProperties.gameWidth, gameProperties.gameHeight, false, false, false, false);
		game.physics.p2.setBoundsToWorld(false, false, false, false, false)
		game.physics.p2.gravity.y = 0;
		game.physics.p2.applyGravity = false; 
		game.physics.p2.enableBody(game.physics.p2.walls, false); 
		// physics start system

	create: function () {
		game.stage.backgroundColor = 0xE1A193;;
		console.log("client started");
		socket.on("connect", onsocketConnected); 
		//listen to new enemy connections
		socket.on("new_enemyPlayer", onNewPlayer);
		//listen to enemy movement 
		socket.on("enemy_move", onEnemyMove);
		//when received remove_player, remove the player passed; 
		socket.on('remove_player', onRemovePlayer); 
		//when the player receives the new input
		socket.on('input_recieved', onInputRecieved);
	update: function () {
		// emit the player input
		//move the player when the player is made 
		if (gameProperties.in_game) {
			//we're making a new mouse pointer and sending this input to 
			//the server.
			var pointer = game.input.mousePointer;
			//Send a new position data to the server 
			socket.emit('input_fired', {
				pointer_x: pointer.x, 
				pointer_y: pointer.y, 
				pointer_worldx: pointer.worldX, 
				pointer_worldy: pointer.worldY, 

var gameBootstrapper = {
    init: function(gameContainerElementId){
		game.state.add('main', main);


New function we added in our client side is onInputRecieved. In part 1 of the tutorial, we moved the player itself in the client and sent our current position to the server. Instead, we’re going to wait for the new positions from the server. We’re receiving the data every 50ms, which is why we’re interpolating between start and end position by calculating the new speed. Wait for onInputReceived by socket.on('input_recieved', onInputRecieved).

Moving on to Server side.

Server: new file, playermovement.js

Create a new folder "physics" in your server folder. And then create a new javascript file called playermovement.js

function movetoPointer (displayObject, speed, pointer, maxTime) {

	pointer = pointer;
	if (maxTime === undefined) { maxTime = 0; }

	var angle = angleToPointer(displayObject, pointer);

	if (maxTime > 0)
		//  We know how many pixels we need to move, but how fast?
		speed = distanceToPointer(displayObject, pointer) / (maxTime / 1000);

	displayObject.playerBody.velocity[0] = Math.cos(angle) * speed;
	displayObject.playerBody.velocity[1] = Math.sin(angle) * speed;

	return angle;


function distanceToPointer (displayObject, pointer, world) {

        if (world === undefined) { world = false; }

        var dx = (world) ? - pointer.worldX : displayObject.playerBody.position[0] - pointer.worldX;
        var dy = (world) ? - pointer.worldY : displayObject.playerBody.position[1] - pointer.worldY;

        return Math.sqrt(dx * dx + dy * dy);


function angleToPointer (displayObject, pointer, world) {

        if (world === undefined) { world = false; }

        if (world)
            return Math.atan2(pointer.worldY -, pointer.worldX -;
            return Math.atan2(pointer.worldY - displayObject.playerBody.position[1], 
			pointer.worldX - displayObject.playerBody.position[0]);


//we export these three functions 
module.exports = {
	movetoPointer: movetoPointer,
	distanceToPointer: distanceToPointer,
	angleToPointer: angleToPointer

In Node.js, order to export functions for others to use, we use module.exports, or else you will not be able to use it when you require the file When we "require" the file, we are able to use exported functions.

The player movement function has the same mechanics in the client. However notice that we use the p2 syntax like playerBody.position[0]. The syntax will be explained later but it's just a p2 way of specifiying x and y positions.

Server: App.js:

var express = require('express');
//require p2 physics library in the server.
var p2 = require('p2'); 

var app = express();
var serv = require('http').Server(app);
//get the functions required to move players in the server.
var physicsPlayer = require('./server/physics/playermovement.js');

app.get('/',function(req, res) {
	res.sendFile(__dirname + '/client/index.html');
app.use('/client',express.static(__dirname + '/client'));

serv.listen(process.env.PORT || 2000);
console.log("Server started.");

var player_lst = [];

//needed for physics update 
var startTime = (new Date).getTime();
var lastTime;
var timeStep= 1/70; 

//the physics world in the server. This is where all the physics happens. 
//we set gravity to 0 since we are just following mouse pointers.
var world = new p2.World({
  gravity : [0,0]

//a player class in the server
var Player = function (startX, startY, startAngle) {
  this.x = startX
  this.y = startY
  this.angle = startAngle
  this.speed = 500;
  //We need to intilaize with true.
  this.sendData = true;

//We call physics handler 60fps. The physics is calculated here. 
setInterval(physics_hanlder, 1000/60);

//Steps the physics world. 
function physics_hanlder() {
	var currentTime = (new Date).getTime();
	timeElapsed = currentTime - startTime;
	var dt = lastTime ? (timeElapsed - lastTime) / 1000 : 0;
    dt = Math.min(1 / 10, dt);

// when a new player connects, we make a new instance of the player object,
// and send a new player message to the client. 
function onNewplayer (data) {
	//new player instance
	var newPlayer = new Player(data.x, data.y, data.angle);
	//create an instance of player body 
	playerBody = new p2.Body ({
		mass: 0,
		position: [0,0],
		fixedRotation: true
	//add the playerbody into the player object 
	newPlayer.playerBody = playerBody;
	console.log("created new player with id " +; =; 	
	//information to be sent to all clients except sender
	var current_info = {
		x: newPlayer.x,
		y: newPlayer.y,
		angle: newPlayer.angle,
	//send to the new player about everyone who is already connected. 	
	for (i = 0; i < player_lst.length; i++) {
		existingPlayer = player_lst[i];
		var player_info = {
			x: existingPlayer.x,
			y: existingPlayer.y, 
			angle: existingPlayer.angle,			
		console.log("pushing player");
		//send message to the sender-client only
		this.emit("new_enemyPlayer", player_info);
	//send message to every connected client except the sender
	this.broadcast.emit('new_enemyPlayer', current_info);


//we're not using this anymore
function onMovePlayer (data) {
	var movePlayer = find_playerid(; 
	movePlayer.x = data.x;
	movePlayer.y = data.y;
	movePlayer.angle = data.angle; 
	var moveplayerData = {
		x: movePlayer.x,
		y: movePlayer.y, 
		angle: movePlayer.angle
	//send message to every connected client except the sender
	this.broadcast.emit('enemy_move', moveplayerData);

//instead of listening to player positions, we listen to user inputs 
function onInputFired (data) {
	var movePlayer = find_playerid(,; 
	if (!movePlayer) {
		console.log('no player'); 

	//when sendData is true, we send the data back to client. 
	if (!movePlayer.sendData) {
	//every 50ms, we send the data. 
	setTimeout(function() {movePlayer.sendData = true}, 50);
	//we set sendData to false when we send the data. 
	movePlayer.sendData = false;
	//Make a new pointer with the new inputs from the client. 
	//contains player positions in server
	var serverPointer = {
		x: data.pointer_x,
		y: data.pointer_y,
		worldX: data.pointer_worldx, 		
		worldY: data.pointer_worldy
	//moving the player to the new inputs from the player
	if (physicsPlayer.distanceToPointer(movePlayer, serverPointer) <= 30) {
		movePlayer.playerBody.angle = physicsPlayer.movetoPointer(movePlayer, 0, serverPointer, 1000);
	} else {
		movePlayer.playerBody.angle = physicsPlayer.movetoPointer(movePlayer, movePlayer.speed, serverPointer);	
	//new player position to be sent back to client. 
	var info = {
		x: movePlayer.playerBody.position[0],
		y: movePlayer.playerBody.position[1],
		angle: movePlayer.playerBody.angle

	//send to sender (not to every clients). 
	this.emit('input_recieved', info);
	//data to be sent back to everyone except sender 
	var moveplayerData = {
		x: movePlayer.playerBody.position[0],
		y: movePlayer.playerBody.position[1],
		angle: movePlayer.playerBody.angle,
	//send to everyone except sender 
	this.broadcast.emit('enemy_move', moveplayerData);

//call when a client disconnects and tell the clients except sender to remove the disconnected player
function onClientdisconnect() {

	var removePlayer = find_playerid(; 
	if (removePlayer) {
		player_lst.splice(player_lst.indexOf(removePlayer), 1);
	console.log("removing player " +;
	//send message to every connected client except the sender
	this.broadcast.emit('remove_player', {id:});

// find player by the the unique socket id 
function find_playerid(id) {

	for (var i = 0; i < player_lst.length; i++) {

		if (player_lst[i].id == id) {
			return player_lst[i]; 
	return false; 

 // io connection 
var io = require('')(serv,{});

io.sockets.on('connection', function(socket){
	console.log("socket connected"); 
	// listen for disconnection; 
	socket.on('disconnect', onClientdisconnect); 
	// listen for new player
	socket.on("new_player", onNewplayer);
	//we dont need this anymore
	socket.on("move_player", onMovePlayer);
	//listen for new player inputs. 
	socket.on("input_fired", onInputFired);


We first require p2 physics for physics calculation.We also require playermovement file for moving the players. We create a new p2 physics world and steps with physics_handler. Documentation here:

First important thing we add is player body when we’re first creating a player. It’s just like p2.js in phaser, but different syntax. We create a body with new p2.Body in OnNewPlayer. We removed OnMovePlayer and added onInputFired. Biggest difference is this: We’re also sending the new position to the sender. To specify x position of the body in the server, we do playerbody[0], and to specify y position, playerbody[1]. Same goes for velocity, we do playerbody.velocity[0] for x and playerbody.velocity[1] for y velocity. Don’t forget to add the playerbody to the world with world.addBody(playerbody) !! or else your player's physics will not be calculated

Now type in "node app" to see your game in action!

In the new tutorial, we’ll focus on the more game mechanics aspect. We’ll add the game mechanics of eating food and other players. We’ll also add experience bar to level up.

If you have any questions please comment below! I'm more than happy to help you

<< Part 1 Part 3 >>