Men the problem is that you dont get that you should never trust the client
use the onPlayerDamage in server side
In this case and even if he cancel the event client side he still dies server side
Only use the onclientDamage if you want to build a ui or some text only for visuals
Don't ever make a system relies to the trust of the client side
Hope you understand what i mean