World of Warcraft — MMO Game Server Architecture

architect25 min

The player launches the WoW client and connects to the Login Server (Battle.net). Authentication uses the SRP-6 (Secure Remote Password) protocol — the password is never transmitted over the network, even in encrypted form. The client and server exchange cryptographic proofs, confirming knowledge of the password without revealing it. After successful authentication, the client receives a session token for subsequent connections.

Why this way?

SRP-6 protects against MITM attacks and password interception. In an MMO with millions of accounts, a password leak is catastrophic. The zero-knowledge proof protocol guarantees that even if the channel is compromised, the password remains safe.

Progress1 / 10

WoW ClientDesktop

Realm ListRealm Service

C++

World ServerZone Handler

C++TCP

Instance ServerDungeon/Raid

C++Lua

Character DBMySQL Cluster

MySQL

World State DBMySQL

MySQL

Chat ServerMessaging

C++

Auction HouseEconomy

C++MySQL

Session CacheIn-Memory

MatchmakingDungeon Finder

CDNPatch Delivery

SRP-6: password is never transmitted over the network

ArchCase

ArchCase