onCreate (options: any) {
    if (options.secret !== "MY-SECRET-VALUE") {
        throw new Error("unauthorized");
    }
}

• 限制相同 id 的房间创建

gameServer
  .define('my-room', MyRoom)
  .filterBy(['id'])
  .maxInstances(1);

• 固定数量的房间创建好之后, 隐藏服务器 API

const gameServer = new Server();
const tempServer = gameServer as any; // force access to private property by casting to any
tempServer.exposedMethods = []; // override property with empty array to not expose those methods anymore
gameServer.listen(port);

• 服务端限制房间创建频率
  https://docs.colyseus.io/colyseus/how-to/rate-limit/