DataStores

[chilly grove]

Hi, I started to develop my DataStore Module yesterday and I was wondering if some of you know any vulnerabilities affecting the DataStoreService. We could try to list all of them here, both well-known and lesser-known, and it would be nice to describe how they work.

[trim moat]

Well. All i know is that :SetAsync() is more unreliable compared to :UpdateAsync(). Atleast I experienced more failed pcalls when using the :SetAsync() method.

[chilly grove]

Indeed

To fix that, I use UpdateAsync() for both data saving and loading

[tall plover]

Uhhhh no

:UpdateAsync() uses two data store api calls, one to set and one to read. That function is just a way to edit already existing data in a data store.

However when a player joins you should set the loaded data store data into a table.

And only auto save every 30 seconds or when the player leaves

[trim moat]

Dang i've always been using :UpdateAsync() in a more kind of overwrite way. I didn't even use the already existing data i just returned the new data in the transformation function.

[tall plover]

Daym

[trim moat]

So for what exactly do you use :SetAsync()?

[tall plover]

To set data

It would replace everything in a key with the data

[trim moat]

But updateAsync does the same job in a more Secure way so what is the difference other than speed

[tall plover]

That’s not how it works

Not at all

[trim moat]

huh

[tall plover]

UpdateAsync just reads what’s in the key, pass it to the server, do something with the data, then pass the edited data back to the data store to save

But it’s basically useless

Because once a player joins to have to GetAsync, save it in a table, and then when the player leaves pass that table to the data store

[trim moat]

But what if you don't use whats in the key and just return new data in the transformation function

[tall plover]

You use :SetAsync

[tall plover]

It would clear the key and replace it with the new data

[trim moat]

but that would work righ? And it would cause no problems?

Genuine question

[tall plover]

Yes it would still work

[trim moat]

but?

[tall plover]

UpdateAsync just reads and sets data

[tall plover]

?

[trim moat]

i thought there was gonna be a downside to it

[tall plover]

Well, you have to use pcall to check if it fails

Cus internet and stuff

[trim moat]

but you have to do the same for SetAsync right?

[tall plover]

UpdateAsync technically has a higher change of failing

[tall plover]

Yes

Even for :GetAsync

[trim moat]

So UpdateAsync is just overall the better method? (Sorry if i don't get it but it just feels like it)

Because UpdateAsync does not only set but also reads and handels Multi Server data changes

[tall plover]

No

[tall plover]

That’s why we have session locking

[trim moat]

What is Session locking

[tall plover]

A way to make sure only one server can edit a key.

[trim moat]

I see

So both methods have their own kind of trade of.

SetAsync() is fast but you have to use Session locking to make sure only one server can edit the key.

UpdateAsync() is safe but slow.

[tall plover]

UpdateAsync also uses two data store requests

[trim moat]

thats why its slow

[tall plover]

Sure

[tall plover]

Session Locking you have to create yourself

But it’s easy

[trim moat]

yeah

[tall plover]

Just use memory service

[trim moat]

Never used that service i'll watch a tutorial for it or read the docs

So just to be sure now. If you've set up a good Session locking system SetAsync will be better than UpdateAsync for saving data because it is faster because it only uses one datastore api request which is to overwrite?

[oak ferry]

Duping items through trade system unless if you did a profile service thingy

[tall plover]

Basically

[chilly grove]

The fact you can check if the data you're about to safe is less or more recent

[chilly grove]

session locking?

I'm probably gonna make that

[chilly grove]

yeah i think of using it

i'll temporary save the state of the profile as locked with a short expiration time so update async has time to save data before

[chilly grove]

i agree on the fact it must be to make, but an experienced colleague keeps telling me it's hard as hell, but i ignore why, that's why ive been hesitating on wether i should make one or not

[tall plover]

Just, on every server check if the session is locked, if it’s not then lock it and proceed with editing data.

[chilly grove]

thought of that but i kept telling myself there was something more than that i could maybe not do

thx

i might do that tmrw cuz ive been developing for 3h30 straight my datastore module

if self.Values then
        local Data = {}
        Data["DataVersion"] = 0
        for Name, Value in self.Values do
            Data[Name] = Value.Value
        end
        local Success, Errormsg = pcall(function()
            MyDataStore:UpdateAsync(self.Key, function(oldData)
                if not oldData then
                    Data.DataVersion += 1
                    return Data                    
                end
                if self.DataVersion == oldData.DataVersion then
                    Data["DataVersion"] = oldData.DataVersion + 1
                else
                    return
                end
                return Data
            end)
        end)
        assert(Success, Errormsg)
    end

that's how I used UpdateAsync() to make sure I save the good data

[tall plover]

Don’t use update async

[chilly grove]

why?

[tall plover]

They use two api calls instead of one

And it’s unnecessary

[chilly grove]

i see what you mean

[tall plover]

One player join -> GetAsync -> Save it in a table

One player leave or auto save -> SetAsync and save the table

[chilly grove]

mk

but isn't updateasync better to prevent data loss?