FoliaLogin

1.1.1

- New: spawn.noReturnWorlds, a list of worlds where the logout position isn't kept (event worlds, minigames…). Players who log out in one of these worlds rejoin at the spawn instead of going back there. ```yaml spawn: noReturnWorlds: ["event"]

1.1.0 – Two-factor authentication & spawn options

New

- Two-factor authentication (TOTP), works with Google Authenticator, Authy, Aegis, 2FAS… - /2fa add <password> shows a key (click to copy), then /2fa confirm <code> enables it - After /login, players with 2FA enter /2fa <code> (alias: /totp) - /2fa remove <code> to disable it, /authme resettotp <player> for admins (lost phone) - Brute-force protection: 5 tries, then kick + temporary lock (survives reconnects). Used codes can't be reused - `/authme setspawn`: saves your position and the direction you're looking as the login spawn - `spawn.forceSpawnOnJoin`: always put players at the spawn when they join - `spawn.spawnWorld`: choose which world's spawn is used (default: main world)

Changes

- The login spawn now uses the main world, not the world the player logged out in - Passwords and 2FA codes no longer appear in the console - Login lockouts now survive reconnects (per account + IP), and /changepassword is rate limited - /authme status now shows whether a player uses 2FA - With premium.allowOfflineMode, accounts that have 2FA must log in with their password + code

Fixes

- With invalidateOnQuit and timeoutMinutes: 0, a player who never logged in could get an auto-login session

Upgrading

Replace the jar and restart. The database is upgraded automatically, and new options are added to config.yml and lang.yml without touching your settings. New permissions: authme.player.totp (everyone), authme.admin.setspawn and authme.admin.resettotp (op).