I have a fast paced multiplayer FPS game with the client running the player movement code and sending its position to the server. Obviously this is open to cheating so I want to have the player movement run on the server with the client sending only input to the server.

I have read all about client side prediction but there's still a few problems I'm not able to solve.

When I sample input and send that packet to the server, by the time the server receives it, the player simulation will have potentially moved the player to a different position than where the clients player was during that input.

One way to solve this is to send the frame time in the input packet to progress the simulation by that amount using that input. The problem with this is that it's also open to cheating, someone could speed up their client so the server simulates the player faster. I'm sure there's ways to detect that but there's still the problem of the player on the server freezing in mid-air when input isn't being received.

So to me it doesn't look like there's a perfect solution to this problem, I want the server to always simulate the player but due to packet latency, it's going to receive input at a different time than the client predicted it, resulting in constant error correction for the player.

An example of this is, imagine the client is predicting the player moving forward and then jumps, the server will be moving the player forward but the input with the jump keypress hasn't been received yet so the player on the server keeps running forward. When the input with the jump key press finally comes in, the player on the server has already ran into a hole but the client predicted that the player jumped over the hole.

Yes, if the client has immediate user feedback, and the server runs the client based on inputs, then the client will be ahead of the server by the one-way latency between the two.

As long as the client and server run the same code, this is seldom a problem, except for the case where the client competes with another client -- who picks up a health pack first, client/client collisions, etc. Exactly how you solve those cases is an important part of how your game design and netcode arrive at the particular "feel" of your particular game.

Even if it's running the same code, the server is using the last received input to drive the player. Without going back in time on the server, actions are going to happen at completely different times than what got predicted. I know that it's going to go out of sync if the server does something to the player that the client can't predict, I'm fine with that. I just can't fix this specific problem without causing some kind of cheating.

One way I thought about solving this is to timestamp the input packets and have the server go back in time to apply inputs and simulate the player from where they actually happened but only allow a small timeframe of about 200ms. That's still open to abuse but maybe there's no stopping that completely.

Perhaps it's better if I just send frametimes to server so it knows how long to simulate for but protect against huge frametimes that can't possibly happen, that way a cheater wont gain an advantage but could freeze the player in mid-air (which may not be an advantage depending on the game)

actions are going to happen at completely different times than what got predicted. I know that it's going to go out of sync

I am assuming that you are fixing your time step, counting steps (not seconds,) and that you are running the client ahead of the server -- when the server is at step N, the client is already at step N+L, such that the client sent the data for step N, L steps ago.

Assuming that the client latency is predictable, the client can "cheat" by introducing additional fixed latency (up to some limit,) but that would also make the reverse problem -- extrapolation of other players -- a lot worse, so nobody would want to do that.

If you want a perfectly level playing field, fix the run-ahead latency of ALL the clients to the same number, and reject clients that can't keep up to that number.

If you want a perfectly level playing field, fix the run-ahead latency of ALL the clients to the same number, and reject clients that can't keep up to that number.

Even then, some of the issues will still remain. If two players hit the health pack in the same update somebody gets it and somebody doesn't. In that case some other priority will take place, such as the lower-numbered player or the one that is first updated in the physics engine.

Perhaps it's better if I just send frametimes to server so it knows how long to simulate for but protect against huge frametimes that can't possibly happen, that way a cheater wont gain an advantage but could freeze the player in mid-air (which may not be an advantage depending on the game)

The details of the solution greatly impact the feel of the game. If you allow longer windows the game starts to feel more 'squishy', or less prone to things not being where they were expected.

For some games that can add to the fun and distinctive feel. I remember a lot of Quake exploits along these lines. One of the more annoying was how some players would literally climb the walls thanks to tiny errors that were only reachable on specific performance configurations, allowing them to unexpectedly cling near the ceiling and snipe everybody spider-man style.

You wrote you want an FPS, which means you will want more precision but it comes at the cost of requiring low latency and small timing windows.

There are many common tricks to make it feel better, such as playing a slightly longer animation for the triggering player, and a shorter animation on the receiving player, with the time difference being roughly the lag time. Even then, the more you push it the more players will complain. See the forum FAQ for links to a bunch of articles that describe other common ways to mask the lag.

In that case some other priority will take place, such as the lower-numbered player or the one that is first updated in the physics engine.

Or coding this explicitly, and either use a deterministic random number generator, or actually detect this and resolve it as "neither player got it."
There are many solutions. Pick the ones that work for your desired gameplay style.