Welcome to the Developer Update for August 28.
Today’s featured world is VRC Volleyball by mamemoyasys.
Announcements
Bigscreen Beyond 2e: VRChat Edition + 10 Years of VRC+ Giveaway
You read that mouthful right! We’re giving away a Bigscreen Beyond 2e: VRChat edition and 10 Years of VRC+ to one lucky X/Twitter user!
Please read the full rules and eligibility requirements here.
You can enter the giveaway by RT’ing the original post here.
Unity Cloth Limits
Did you know that VRChat supports Unity Cloth?
If you did, this part is for you.
You might be aware that Cloth components with many affected vertices come with a hefty performance cost. This occurs on load, during avatar scaling, and even just at runtime. Some of this cost scales quadratically! 
To limit this performance impact, we have begun adding hard limits to how many vertices a cloth component can affect before being removed by our server-processing step.
The limit, for now, is focused on crasher prevention – that is, you should not see this affect any meaningful amount of content, as anything processed this way would have previously crashed you.
Note that this will not fail Server Processing – it will just remove the Cloth component in that case.
Looking at our analytics, of the few avatars that use Cloth, their median affected vertex count is about 1700. For reference, the Very Poor limit is 200. And while PhysBones are a staple of VRChat avatar creation, less than 3% of avatars use Unity Cloth at all.
Realistically, a lower hard limit could really help avoid avatars with very bad performance, and so we came up with the idea of limiting it further to a maximum of 2000 or so.
We know, however, that this would break some amount of content, without giving a straightforward replacement in all cases.
In many, but not all cases, PhysBones can be used to replace functionality, but there is no cloth-physics replacement available in VRChat at the moment. We also lack the resources to add this any time soon, before you ask. And yes, this includes supporting third-party assets like Magica Cloth.
So to better understand the edge cases here, we figured we’d just ask directly. Are there any use-cases for Unity Cloth that require more than 2000 (or less/more) affected vertices? Would you be in favor of a reduced hard limit to avoid not just crashers, but also reduce the amount of avatars causing hard stutters on loading and scaling further?
Let us know!
Steam Audio Beta Updates
Scheduled reminder that we are still testing Steam Audio via the steam-audio-beta Steam branch! Anyone can opt-in, and you can check our Discord for more info and patch notes.
Last Friday, we release a major update featuring lots of bug fixes and a new HRTF. An HRTF, or Head-Related Transfer Function, is a function that models how a sound changes based on factors like its position relative to the listener and the listener’s head/torso/ear shape.
This is how, in many games like VRChat, you can determine where a sound is coming from more accurately than with simple stereo audio – you can (usually) tell if it’s coming from above you or below you, or in front of or behind you, and how far away it is.
There is no proper ‘universal’ HRTF that works perfectly for everyone, however, so there’s some amount of subjectivity involved, and we’re trying to land in a place that’s as comfortable as possible for as many people as possible.
Any feedback we can get about how audio sounds for you right now is helpful, as it may give us the necessary info to find the average we need to make it sound good for most people.
Before giving feedback, we recommend using the new build for at least a few hours. It can take your brain a bit of time to adjust to a new HRTF model!
You can leave your input on our dedicated Steam Audio Canny board! This board is not limited to just bug reports.
New Avatar Marketplace Row!
The Avatar Marketplace has a New Row… the New Row!
This has been available to all users for a couple of weeks, but we recently tweaked how it works to optimize it and make it a little snappier.
If you were looking for a way to see the latest content that’s available on Avatar Marketplace, come visit the Avatars Explore tab today and check out the “New” row!
…and hey, if you’re an avatar creator, there’s never been a better time to hop in!
AutoHold for VR Update
As we first shared in the July Creators Roadmap update, we’re updating Pickup components to support Auto Hold for all input types! This allows world creators to make pickups that stay in your hand without needing to hold the “Grab” button. It works on every platform - PC, VR, and mobile! This was previously not possible with most VR game controllers or Hand Tracking.
It’s very simple: just grab once to hold, then grab again to release. Check out the demo below to see it in action.
It won’t change how any existing pickups work, but you’ll start to see the new ‘stickier’ pickups after we release the SDK and creators update their worlds.
2FA Verification Failing Randomly? We Fixed It!
Some of you ran into a frustrating loop: you’d enter a valid 2FA code, only to be told it was invalid, again and again. This issue affected logins across the VRChat app, the VRChat website, and any third-party apps using our API.
It crept in gradually over the last ~3 weeks. We finally figured out what was happening and resolved it this Monday after which 2FA failures dropped immediately to normal levels.
In almost all cases, you don’t need to do anything, but if you still see this issue happening, try logging out and back in again.
What Happened?
A change rolling out in our upstream provider’s caching system interacted badly with our long-standing “cache-and-revalidate-everything-by-auth-cookie” caching rule.
In some cases, clients ended up not sending the fresh auth cookie during 2FA verification, or they sent an outdated one, causing perfectly valid 2FA codes to be rejected.
We disabled the specific cache rule on Monday, immediately clearing up 2FA verification failures. Around 8% of 2FA verification API requests representing around 5% of users were affected. Some users were able to pass 2FA verification after a few hours while others were temporarily locked out of their account until the fix was rolled out.
I want to go DEEPER
okay fine
So, our normal login flow looks something like this:
- Client submits username/password to
/api/1/auth/user. - Server responds with a
Set-Cookie: auth=authcookie_b7f9961e-e6b0-46cf-9869-fce1d22b93c4; ...header and (if needed) indicates the next step is to 2FA-verify. - User retrieves a TOTP code from an authenticator app and types it into the client which submits the code to
/api/1/auth/twofactorauth/totp/verify, including the current auth cookie.
We started seeing intermittent cases where step 3 arrived without the expected auth cookie, or arrived with an older, outdated/invalidated auth cookie despite us having just sent a new one in step 2.
From the server’s perspective, this looks like you’re not authenticated at all, returning an error.
What’s Caching Have to Do With It?
- We proxy API traffic through Cloudflare to our server provider.
- To reduce our server provider’s egress fees, we’ve long used a Cloudflare rule that force-caches responses but revalidates on every request, with the cache key varying by the auth cookie (and a couple other headers and cookie values).
- This ensures users never see someone else’s data and that cached responses always get revalidated before being sent back to the user, avoiding sending stale response data while still cutting bandwidth when response bodies haven’t changed across multiple requests.
Recently, as Cloudflare started rolling out a change to their caching system, this rule began to misbehave in edge cases around that auth cookie transmission.
The practical symptoms are that after we sent that new auth cookie in the Set-Header to the client, the next request from the client did not contain that same auth cookie anymore, instead either providing a stale one or none at all, leading to the 2FA rejection.
How We Fixed It
We disabled the forced-response caching rule across our API endpoints and only left some very specific rules active.
This didn’t increase our API server load and users shouldn’t see any difference in behavior (except for 2FA verifications now working again).
A Note on Tests
We’ve noted this in past Dev Updates, but wanted to remind folks that we’ve been testing things.
What things? It depends!
Sometimes we’ll be very transparent about what’s being tested, although not always, depending on if we feel that extra knowledge might impact the results of the test.
When we’re testing something, you might notice that your experience(s) are a little different from your friends. While we’ll try to let the community know if we’re testing something really noticeable, don’t panic if something appears different!
A Note on Security
A third-party tool often used for asset ripping (and sometimes even by well-meaning users just trying to back up their avatars) recently suffered a breach, exposing usernames and passwords.
When working on projects, be sure to keep proper backups before you upload. Version control, cloud storage, or even a simple archive can save you from major headaches!
And most importantly, never put your account credentials into un-trusted tools!
Conclusion
That’s it for this Dev Update! We’ll be back September 11!