"Invite only" can be joined without being invited
Reimajo
Currently, if you invite a person to an "Invite only" instance, the resulting invite link allows anyone to join that instance. It is not limited to the person that got invited.
This is causing issues for events that wants to protect themselves against malicious people raiding an instance. It is a reasonable request that an "invite only" instance only allows invited people to join, not anyone else.
To solve this issue, the invite link needs some kind of user-token so that it only works for the invited person. Or the server could have a list of invited people and requests from other clients which are not on that list are simply ignored.
Log In
ni1chigo2115
I think go to future suggest
GotoFinal
Tho I would like to be a separate feature then, as I believe current behavior is useful too, like to creatre new room and just posting link on discord. Or for easier rejoining after being already invited once.
2 scenarios:
A)
I create a new room, via vrchat or webiste, instance id: 1~nonce(123)
I can then join to it via my link with my security token 1~nonce(123)~token(myToken)
I can also invite a friend "John" from game and they will get an invite with 1~nonce(123)~token(uniqueJohnTokenForThatInstance)
No one else can join, and nothing can be leaked, everything is 100% safe, and I need to manually invite anyone I want here, but I'm sure that no one else will be there.
B)
I create a new room, via vrchat or webiste, id: 2~nonce(432)
I click on special button on webiste or client to generate my master token: 2~nonce(432)~token(specialRandomizedMasterToken)
I share a link on my discord and everyone can join, and if they are shitty people they can share it, but I don't care, at least i dont need to invite people manually and I trust them enough to do so
I kinda used syntax similar to current instance ids.
Fusl
GotoFinal: Additional example of scenario B: Put the vrchat:// launch link into the VRChat launch options in Steam for multiple users that want to join the same home instance when they get online.