Password Protect Room
Colyseus has no built-in password concept. You compose one from three primitives. filterBy() groups same-password players into the same room, and unlisted hides the room from your room browser. An onAuth() check rejects wrong passwords on every join path (including joins by room ID).
Not sure what unlisted and private mean? See Matchmaking Properties.
Allow the matchmaker to identify the "password" field
Define the "password" field inside the filterBy() method. joinOrCreate() then only matches rooms created with the same password:
import { defineServer, defineRoom } from "colyseus";
const server = defineServer({
rooms: {
battle: defineRoom(BattleRoom).filterBy(['password']),
}
});A filter field only constrains matchmaking when the client provides it. A client that omits password entirely can match any room. Always send the field, even when empty (password: ""), and keep the onAuth() check from step 3 as the safety net.
Store the password and unlist the room
Keep passworded rooms out of lobby/listing queries with unlisted:
export class BattleRoom extends Room {
password: string | undefined;
onCreate(options) {
if (options.password) {
this.password = options.password;
this.setMatchmaking({ unlisted: true });
}
}
}Don’t use setPrivate() here. A private room is excluded from joinOrCreate() matching, which defeats step 1: players sending the correct password would silently create a new room instead of joining the existing one. unlisted hides the room from listings while keeping it matchmade.
Reject wrong passwords in onAuth()
joinById() ignores filterBy(), so anyone holding the room ID could walk in without a password. The room’s onAuth() runs before every join, on every join path, so it closes that hole:
import { Room, ServerError } from "colyseus";
export class BattleRoom extends Room {
// ...
onAuth(client, options) {
if (this.password && options.password !== this.password) {
throw new ServerError(400, "wrong password");
}
return true;
}
}