— Written by Tarun Singh Bisht, VP – Game Development, MPL

Card games have been a staple in many of our childhoods — easy to pick up, fun to play, and a great way to spend time with friends and family. As the global online gaming audience continues to grow, these nostalgic casual card games have found a new life in digital formats, bringing people together whether they are at home or on the move.

In the skill-gaming space, server authority is especially crucial to ensure fair gameplay, consistent game states, and robust security against cheating. This article delves into the core architecture of server-authoritative card games, highlighting key technologies and best practices.

Introduction to Server-Authoritative Architecture

Why Server Authority Is Important

• Fairness and Integrity: By executing all critical game logic on the server, players cannot manipulate the game state through hacks or exploits. This creates a level playing field for everyone.
• Consistent Game States: The server is the single source of truth, so all players view the same game state, mitigating discrepancies caused by client-side processing or unreliable network connections.
• Security and Trust: In real-money gaming, building player confidence is paramount. A server-authoritative model ensures the game remains tamper-proof and transparent.

Architecture Overview

Client-Server Model

In a server-authoritative setup, the client primarily handles the user interface and sends player actions to the server. The server processes these actions and returns the updated game state to all connected players.

State Management

Server-side state management ensures that all players share a consistent view of the game at any point in time. The state includes:

• Current turn information
• Player statuses (connected, disconnected, timed out)
• Cards in play and remaining in the deck

Data Flow

• Client Input: The client sends an action (e.g., draw a card, place a bet).
• Server Validation: The server validates the request and updates the game state if it’s valid.
• Broadcast: The server then broadcasts the updated state to all players.

Server-Side Implementation

Redis as an In-Memory Database

To ensure high-speed data access and low-latency operations, Redis was chosen for storing game configurations and states:

• Real-Time Performance: Redis’s in-memory data structure provides rapid retrieval and updates — ideal for fast-paced card games.
• Pub/Sub Mechanism: Essential for notifying connected clients or microservices about updates (e.g., turn changes).
• Scalability: Redis supports distributed caching, enabling easy handling of increasing user loads.

Turn-Based Gameplay with Scheduling

In turn-based card games, each player has a specific amount of time to take an action. To handle scenarios where a player might be disconnected or fails to act in time:

• A scheduler runs for every game instance to track the turn timer.
• If a player does not act within the allocated time, the scheduler initiates a predefined action (e.g., folding, passing) on the player’s behalf.
• The turn then moves to the next player, and the updated state is broadcast to all players.

State Machines for Player and Table Management

Network fluctuations can cause delays in communication between players and the server. To ensure that these delays don’t disrupt gameplay:

• A state machine is maintained for both the user and the game table.
• This machine records the next expected action from each player.
• If the player doesn’t respond, the system automatically transitions to the next state after the time limit, ensuring gameplay continuity.

Random Number Generator (RNG) Certification

Fair card dealing is ensured through certified RNG algorithms:

• Uniformity: Every card has an equal probability of being dealt.
• Unpredictability: Prevents patterns or exploits.
• Repeatability: Under the same conditions, the algorithm yields consistent results, instilling player confidence.

Security Considerations

• Collusion Detection: An in-house data model monitors:
• Play patterns (e.g., the same group repeatedly joining tables).
• Geographic proximity and device information.
• Suspicious behavioral patterns trigger alerts and potential device blacklisting.
• Input Validation: Using libraries like JOI, all incoming data is thoroughly validated before the server processes it. This blocks malicious payloads.

Network Communication

TCP & WebSocket: Although UDP can be faster in some scenarios, the reliability required by turn-based games made TCP a better fit. WebSocket (via Socket.IO) offers robust real-time communication.

Custom Telemetry: Built on top of OpenTelemetry to monitor connection health, latency, and server performance. Continuous tweaks to server location, load balancer configurations, and network settings helped minimize lag.

Testing and Debugging

Integration Testing

Comprehensive integration tests ensure that all components — client, server, and supporting microservices — function seamlessly:

• Staging Environments: A staging setup mirrors production, allowing thorough testing.
• Redis State Updates: Concurrent actions (e.g., user turn vs. disconnection/reconnection) can lead to state conflicts. Techniques like state machines and Redis locks resolve these concurrency issues.

Performance Testing

• Stress and Load Testing: Tools like Locust help simulate heavy user traffic to identify bottlenecks.
• Server CPU Usage: A spike was detected under simultaneous connections and reconnections. Redis Locks and other optimizations helped reduce CPU overhead.

Debugging Tools

• In-House Dashboard: Offers real-time insights into game states and network communication.
• gRPC WireMock and Kibana: Used for network traffic analysis and log monitoring. They helped identify and fix synchronization issues between client and server states by implementing state-based event ordering.

Deployment and Scaling

Server Infrastructure

• Resource Optimization: Based on performance tests and projected traffic, instances are sized for CPU, RAM, and network throughput.
• Clustering: Multiple game-server instances form a cluster, aiming for around 55–60% CPU utilization at peak. This approach leaves headroom for sudden spikes and ensures stable performance.

Load Balancing

• Traffic Distribution: Load balancers use algorithms like round-robin and least-connections to evenly distribute requests.
• Geo-Load Balancing: Routing users to the nearest server region reduced latency by approximately 40%, greatly improving the gameplay experience.

Monitoring and Logging

• OpenTelemetry: Collects metrics from game servers, stored in Prometheus for analysis.
• Grafana: Visualizes these metrics and sets up alerts.
• Kibana: Centralized logging and search capabilities facilitate rapid troubleshooting.

Best Practices and Common Pitfalls

• Maintain a Single Source of Truth: Keep critical logic on the server to prevent exploits.
• Use Reliable Real-Time Communication: Turn-based games benefit from the reliability of TCP/WebSocket.
• Validate Early and Often: Prevent malicious or invalid input from ever reaching core game logic.
• Plan for Network Fluctuations: State machines and timed actions ensure a smooth experience despite disconnections.
• Implement RNG Certification: Build player confidence with transparent, fair dealing.
• Automate Scalability: Use cloud orchestration and load balancing to handle traffic spikes without downtime.

---

Building a server-authoritative card game demands careful attention to architecture, security, and performance. By centralizing game logic on the server, employing robust in-memory data stores like Redis, and ensuring reliable network communication, you lay the foundation for a fair, scalable, and secure gaming platform. With thorough testing, proactive monitoring, and best practices in place, you can confidently offer an enjoyable and trustworthy gaming experience to players worldwide.