Client-side versus server-side hit detection

Let's take a look at what our client-side and server-side hit detection might look like. For client-side hit detection, you perform the hit detection on the client and directly generate a damage message to send to the server. For instance:

using UnityEngine;
using System.Collections;

public class WeaponScript : MonoBehaviour
{
  public float Damage = 10f;
  public LayerMask HitLayers;

  public void Fire()
  {
    RaycastHit hit;
    if( Physics.Raycast( transform.position, transform.forward, out hit, 100f, HitLayers ) )
    {
      // a script on the object could handle this by generating an RPC, for example
      hit.collider.SendMessage( "TakeDamage", Damage, SendMessageOptions.DontRequireReceiver );
    } 
  }
}

It's very short, simple, and incredibly easy to understand. However, it's also incredibly open to hacking. Players can easily spoof the damage message to send damage messages to whoever they wish, and they...