peyaj's Auth [Paper/Velocity]

Improvements

* Added /auth changepassword <player> <newPassword> and /auth setpassword <player> <newPassword> to proxy commands, allowing network staff to reset player passwords directly with real-time notification to the player if online. * Added peyajauth.changepassword.admin check alongside peyajauth.admin, allowing server owners to grant password management privileges to moderators without giving full root admin permissions. * Added configurable password complexity requirements (password.require-number, password.require-uppercase, and password.require-lowercase) across /register, /changepassword, and /auth changepassword to match Paper parity. * Resetting a password administratively now invalidates stored session tokens and expiry dates so players are forced to log in with their new credentials.

Fixes

- Fixed Floodgate Bedrock checks to use official API validation, preventing prefix spoofing and account takeovers. - Fixed database error handling across proxy auth commands so database outages fail safely. - Fixed two-factor authentication on Velocity proxies so 2FA codes are verified directly during proxy login. - Fixed logout command to de-authenticate players on backend servers and return them to the limbo waiting room. - Fixed brute-force protection to track failed attempts and disconnect players who exceed limits. - Fixed duplicate listeners to resolve command conflicts and allow disconnect for unauthenticated players. - Fixed title display timings so fade-in, stay, and fade-out durations are properly applied. - Fixed prompt spam by removing redundant limbo auth reminders and accurately distinguishing premium accounts.

Improvements

- Added support for session duration and remember-login settings from proxy configuration. - Added startup warnings when the auth bridge secret is left empty. - Improved login command concurrency to prevent race conditions during rapid authentication attempts. - Improved captcha generation by using a cryptographically secure random generator.

Changes

* discord webhook notifications across your proxy for registrations, logins, failed attempts, brute-force lockouts, password changes, 2FA setup, and admin commands. * performance improvements * some bug fixes on importing data from other auth plugin

Connection Fixes

* Verified premium (online-mode) players now bypass the internal Limbo server. * Added active server connection deduplication in redirect routines to prevent redundant server switch requests. * Fixed an issue where players with an existing premium account were blocked by /premiumverify with an incorrect password prompt. * Minecraft 26.3 Support

Security Hardening

* Intercepted incoming PluginMessageEvent to drop any client-injected packets from cheat clients, preventing forged proxy authentication bypasses. * Added HMAC-SHA256 signatures with timestamp expiration to proxy-to-server auth sync packets. * Removed unsafe auto-authentication of offline-mode players in Limbo when matching a premium username. Offline players attempting to access premium accounts are strictly required to verify ownership via /premiumverify. * Denied Bedrock auto-bypass if an existing account exists in the database with a non-matching UUID, protecting both premium and cracked accounts from being hijacked.

Velocity Commands Polish

* I forgot to load other commands for velocity, only reg and login was loaded, so now its fix thanks to Crisopeo for reporting!

changelogs

* made it a 10-second looped chat reminders for the interactive [ YES ] and [ NO ] clickable buttons for idle unregistered players. * synchronized proxy session protocols and database schemas with the Paper 1.6.7 release.

Added

Velocity Forced-Hosts Support*: Added proxy.follow-forced-hosts in config.yml (enabled by default). When players join using domain subdomains mapped in Velocity's [forced-hosts] (e.g. survival.example.com), they authenticate in Limbo and are automatically sent straight to survival upon login instead of the generic lobby! Custom Auth Lobby Server Option*: Added limbo.enabled: false and limbo.auth-server in config.yml allowing networks to route unauthenticated players to a dedicated Paper lobby instead of the virtual Limbo void.

QoL fixes

Disconnect Safety*: Added automatic memory cleanup for intended destination servers upon player disconnect.

Features

Custom Auth Lobby Support*: Added limbo.enabled (default true) and limbo.auth-server (default "auth") in config.yml. Networks can now choose between the built-in virtual void Limbo or routing unauthenticated players to their own dedicated Paper auth lobby server.

Localization & Parity

Ukrainian Language Support: Added full Ukrainian translation (`messages_uk.yml`) for proxy prompts, errors, and titles with automatic client locale detection (`uk`). (Thanks to [binraptor!](https://github.com/binraptor))*

peyajAuth Velocity 1.6.4

New Features

Proxy ➔ Paper Auth Bridge (IMPROVED)*: improved the peyajauth:auth_bridge plugin messaging pipeline to automatically forward authentication and premium states to backend Paper servers in real-time. Eliminates double-authentication across the entire network. Multi-Language (i18n)*: Added automatic client locale detection with built-in translation bundles for English (en), Spanish (es), Russian (ru), and Chinese (zh).

Bug Fixes & Security

Account IP Lock Wildcard Fix: Fixed an issue where wildcard patterns (e.g., `10.0.0. or 192.168.*`) were treated as literal text instead of wildcards. CIDR Subnet Validation*: Added bitmask-based network subnet validation for Account IP locks supporting IPv4 (10.0.0.0/24, 172.16.0.0/12) and IPv6 (2001:db8::/32).

Bug Fixes

Adventure API Version Conflict Fix*: Resolved a critical NoSuchMethodError related to Title.Times.of(...) that would cause players to disconnect upon joining. This occurred when running the plugin on newer Velocity versions (e.g., Velocity 4.1.0 Snapshot) that use Kyori Adventure 4.17.0+ where the old method was removed. Title API Refactor*: Refactored the title display logic to use a version-agnostic implementation, ensuring 100% compatibility across all older and newer Velocity versions.

Features

Configurable Messages & Prefixes*: Added full support for customizing all plugin messages (prompts, errors, kicks, captchas, etc.) via messages.yml using the MiniMessage format. A configurable prefix setting has also been added, which can be injected dynamically into any custom title or message using the {prefix} placeholder! Live Reload Command*: Added the /peyajauth reload administrative command to instantly apply config.yml and messages.yml changes without requiring a proxy restart.

* fixed misconfiguration of floodgate-auto-bypass setting in premium.yml. it still has issues of 26.2 below client version would get network protocol error, no eta for fixing the issue yet.

peyajAuth-Velocity v1.6.1

peyajAuth-Velocity v1.6.1 introduces a zero-dependency Embedded Void Limbo Server, automated Schematic NBT Normalization to prevent startup crashes, robust Lobby Redirection for auto-login players, and premium visual screen titles. ---

Built-in Zero-Dependency Void Limbo Server

* Native Limbo: Velocity installations now spin up their own virtual void limbo server locally (127.0.0.1) on a dynamically allocated port. * No API Required: Everything runs out of the box. * Void Dimension: Unauthenticated connections spawn in a customizable void platform (using a standard Sponge .schem file).

Seamless Lobby Redirection

* Direct Join: Auto-login session resumes and verified premium connections now bypass the limbo server entirely and connect straight to the lobby server. * Clean Handshake: Solves the initial connection racing condition where auto-login players were left stranded inside limbo.

Visual Titles and Clean UI

* Looping Titles: Unregistered players will see a repeating screen Title reminder asking them to select their registration mode. * Clean Chat: Removed bulky border lines from chat messages. Clickable YES/NO buttons are sent once on join to prevent chat spam, while the Title loops to keep the instruction clear. * Connection Buffering: Delays prompts by 2 seconds after the player successfully establishes their backend connection, ensuring messages are never lost during loading screens.

v1.6.0 Changelog

peyajAuth v1.6.0 introduces powerful advanced security features, including Two-Factor Authentication (2FA), recovery email confirmation codes, packet-based inventory hiding, independent login/registration timeouts, and native compatibility updates for Minecraft 26.2 and Java 25. ---

Key Highlights

Google Authenticator Two-Factor Authentication (2FA)

TOTP Security*: Players can now secure their accounts using standard Google Authenticator or Authy apps. Restricted State*: Players with 2FA enabled are kept restricted (unable to move, execute commands, use chat, or see their inventory) even after inputting their password correctly, until they execute /2fa verify <code>. Admin Bypass*: Operators can force-disable 2FA for a player who lost access to their authenticator device using /auth 2fa disable <player>.

Linked Recovery Emails with SMTP Verification

Linked Accounts*: Players can link a recovery email address to their account to facilitate password resets. Verification Codes*: Adding or changing an email address dispatches a random 6-digit confirmation code to the email. The player must run /email confirm <code> in-game within 5 minutes to finalize the change. Local Fallback*: If SMTP is disabled or connection fails, the plugin automatically falls back to local in-game verification (/email confirm without a code), ensuring no broken features.

Packet-Based Inventory Hiding

Visual Privacy*: Unauthenticated players see an empty inventory screen client-side, preventing item leakage. Normal inventory contents are safely restored sync on the main thread upon successful login.

Separate Login & Registration Timeouts

Dynamic Timeouts*: Replaced the single timeout setting with two separate configurations: login-timeout and register-timeout. Better UX*: Allows administrators to give new players more time to register passwords while enforcing strict, faster timeouts on existing players logging in.

Minecraft 26.2 & Java 25 Support

PacketEvents 2.13.0*: Upgraded PacketEvents dependency to resolve startup class mapping conflicts on Minecraft 26.2 servers. Cross-Version Compatibility*: Shaded dependency libraries (including Adventure API) directly into the JAR without relocation, allowing the plugin to run natively on both Minecraft 1.21.x (Java 21) and Minecraft 26.2 (Java 25) servers. ---

Commands & Permissions Reference

* /2fa <setup|confirm|disable|verify> - Manage Google Authenticator settings (Default: Everyone). * /email <add|change|remove|confirm|show> - Manage recovery email links (Default: Everyone). * /auth 2fa disable <player> - Disable 2FA for a player (Default: OP, Permission: peyajauth.admin).

v1.5.3 Changelog

peyajAuth v1.5.3 introduces significant performance optimizations, automated database backups, and asynchronous chunk-loading teleportations to deliver a flawless, high-performance authentication experience. ---

Key Highlights

Zero-Lag Salted SHA-256 Hashing (New Default)

Instant Logins: Replaced the heavy default Argon2id settings with an ultra-fast, hardware-accelerated Salted SHA-256 Hasher*. 0% CPU Starvation: Password verification now executes in 0.1 milliseconds* (1000x faster than BCrypt/Argon2), preventing CPU starvation and eliminating command login lag spikes. Seamless Migration*: Built-in automatic format detection verifies existing BCrypt or Argon2id hashes flawlessly without breaking current player account data.

Automated SQLite Database Backups

GZIP Compression*: Automatically copies your SQLite database file (auth.db) and compresses it into a GZIP archive (.db.gz), keeping backups extremely small (only a few KB). Async Scheduler*: Scheduled tasks run asynchronously in the background at startup and on a configurable interval (default: every 24 hours), avoiding main server thread ticks. Auto-Cleaning Retention*: Automatically keeps only the newest backup files (default: 7), cleaning up older files to save disk space.

Asynchronous Teleportation (teleportAsync)

Eliminate Spawn Lag: Upgraded spawn lobby teleportations and position restorations from synchronous calls to Paper/Spigot's non-blocking `teleportAsync`* API. Smooth Chunks*: Offloads chunk generation and loading to background threads when players join or log in, ensuring 20.0 TPS is maintained. ---

Config & Defaults Updates

Remember-Login*: Disabled by default (enabled: false) to avoid unnecessary pre-login database lookups. Session Timeout*: Lowered default session timeout to 5m (down from 30m). Premium Skin Caching*: Added local cache skinCache for skin properties inside MojangService to prevent repeated Mojang API network lookups. Turned fetch-premium-skins to false by default to avoid connection queues. Non-Blocking History Logs*: Removed blocking .join() statements from database logging operations. Live Config Reloads*: All configurations (sessions, update checker, database backups) reload instantly via /auth reload without requiring a reboot.

v1.5.2 Changelog

Added

* Added support for visual on-screen titles and subtitles during the authentication phase (prompts players dynamically to login/register). * Added a blindness potion effect restriction for unauthenticated players to blank out the world and secure coordinates/builds prior to authentication. * Added support for disabling the login timeout kick entirely by setting "login-timeout" to 0 or -1 in the configuration. * Added a dedicated "session-resume" message configuration key for custom message display on session recovery.

Optimized

* Optimized connection handshake performance by caching NMS packet constructors and lazily caching NMS network manager encryption methods, eliminating runtime reflection search overhead during player join spikes.

v1.5.1 Changelog

Added

* Integrated bStats metrics tracking to monitor active server installations and player counts in real time (relocated to prevent library conflicts with other plugins). * Added dynamic bStats indicators to documentation.

Fixed

* Fixed a pipeline decryption issue where premium connections on modern Minecraft versions (1.20.5 / 1.21 / 26.x) got disconnected with a "CorruptedFrameException: Frame length cannot be zero" error. The plugin now reflectively injects the NMS ServerboundHelloPacket directly to the packet handler, bypassing the Netty cipher and preventing packet scrambling. * Fixed a vulnerability where cracked connections could attempt to spoof premium player UUIDs during login. The connection is now strictly terminated immediately if session verification fails to return a valid Mojang authentication state.

peyajAuth v1.5 - Changelog

peyajAuth v1.5 is a major release featuring a complete overhaul of the packet interception layer, smooth gameplay restrictions, and significant security hardening. ---

Key Highlights

ProtocolLib Removal and PacketEvents Migration

Zero-Dependency Standalone Build*: Migrated the entire packet interception layer from ProtocolLib to PacketEvents 2.12.0. Reduced Maintenance Overhead*: Eliminates the risk of startup crashes during minor Minecraft protocol changes. Fully Shaded*: PacketEvents is now shaded and relocated inside peyajAuth.jar — ProtocolLib is no longer required.

Smooth Freeze Mechanics (No More Jitter!)

Horizontal Walk/Fly Speed Lock*: On join, unauthenticated players now have their walking and flying speeds locked to 0.0f. This blocks the client-side physics engine from attempting movement, completely eliminating horizontal rubber-banding. Horizontal-Only Position Lock*: Position resets now lock X and Z coordinates only. Target Y coordinates are preserved, allowing gravity, falling, and jumping to simulate smoothly without server-reset twitching. Speed Cache Restorations*: Original player speeds are recorded and restored seamlessly upon successful authentication (safely falling back to default values).

Strict Premium Verification and Takeover Protection

Strict Online Mode Enforcement*: Any player connecting with a username marked as isPremium in the database is strictly forced to complete Mojang's cryptographic encryption handshake. Anti-Spoofing and Bypass Block*: Premium players can no longer fall back to cracked mode (even if allow-premium-usernames is enabled) or bypass verification. Outage Takeover Protection*: If Mojang authentication servers go down, any connection attempt for a registered premium account is kicked immediately rather than falling back to cracked mode, preventing takeover attempts while authentication is offline. Decryption Hardening*: If the client sends a malformed or tampered encryption response, the connection is instantly disconnected rather than falling back to cracked.

Secure Proxy Tracking

Unique Netty Channel Keys*: Replaced IP-based state tracking with unique Netty Channel ID long text hashes (channel.id().asLongText()). This uniquely identifies the exact TCP socket connection, preventing state collisions or state poisoning when running behind BungeeCord/Velocity proxies where ports are recycled.

Username Format Validation

SSRF and Malformed Request Protection*: Added regex-based username validation (^[a-zA-Z0-9_]{2,16}$) immediately after receiving the LoginStart packet. Connections with malformed usernames are dropped before triggering any Mojang API or database operations. ---

Internal Refactoring and Fixes

RSA Key Hardening*: Ephemeral RSA keys generated on server startup have been upgraded from 1024 to 2048 bits.

peyajAuth v1.4 Changelog

peyajAuth v1.4 introduces updates to auto-login detection, Bedrock player compatibility, skin restoration, and API integrations for Spigot, Paper, and Folia (1.21+).

Key Features & Enhancements

Hybrid Auto-Login*: The plugin now intercepts the connection during the LoginStart phase to compare the client-provided UUID against Mojang's database. Premium clients will auto-login, while cracked clients using premium names will bypass encryption and be prompted for a password instead of being kicked with an "Invalid Session" error. Bedrock Temporary Player Fix*: Resolved a critical "UnsupportedOperationException: getUniqueId is not supported for temporary players" by refactoring the Floodgate connection checks to use reflective Netty ChannelPipeline checks during early login stages. Bedrock Player Prefix Restoration*: Fixed conflicts where external skin-rendering plugins (like SkinsRestorer) strip Bedrock name prefixes (e.g. ".") during join. The plugin caches and restores the prefixed player profile. Offline Premium Skin Retention*: Added dynamic online skin fetching. If cracked/offline players connect using a premium username, the plugin will fetch their skin from Mojang session servers and apply it to their cracked profile automatically. Outage Fallback Policies*: Added configurable behaviors during Mojang API outages (defaulting to kicking the player to protect their credentials). API Extensions*: Added the "isBedrockPlayer(Player player)" method to the public PeyajAuthAPI interface.

Security Fixes

Premium Account Impersonation Protection*: Fixed a critical vulnerability where a cracked player joining with a premium username could be automatically logged in as the premium account owner due to the account cache incorrectly marking their connection as premium. Session Hijack Prevention*: Session auto-login now verifies the connecting player's UUID matches the stored offline or premium UUID. Previously, only IP was checked — meaning an impersonator on the same network (LAN, VPN, shared WiFi) could inherit the real player's active session. Registration Race Condition Fix*: Registration now uses atomic database inserts (INSERT IGNORE) instead of upserts (ON CONFLICT UPDATE) to prevent a race condition where a cracked impersonator's registration could silently overwrite an existing premium account's password hash and data. Brute Force Lock Scope Fix*: Account-level brute force locks no longer block players at the pre-login stage. They are now enforced only at the /login command level, so a real premium player can still join and auto-login via the encryption handshake even if an impersonator triggered the account lockout by spamming wrong passwords. Correct Password Bypass on Account Lock*: If an account is locked due to brute force attempts by an impersonator, the real account owner can still log in by entering the correct password. Wrong password attempts while locked will show the lock message, but correct passwords will always succeed and reset the lock. This ensures legitimate cracked players are never locked out of their own accounts.

Configuration Additions (premium.yml)

New settings inside premium.yml: ```yaml

Fallback behavior when Mojang API is offline

mojang-outage: # Options: # 'crack' - Treat premium players as cracked and force them to register/login with a password. (Safe) # 'kick' - Kick premium players when Mojang API is down. (Default) fallback: kick kick-message: "<red>Mojang authentication servers are currently down. Please try again later."

Settings for cracked/offline players connecting with premium usernames

cracked-players: # Allow cracked players to connect using premium usernames. # If true, the server detects if the client UUID matches the premium UUID. # Real premium players will bypass login automatically, while cracked players will bypass encryption # and be prompted to register/login (preventing "Invalid Session" kicks). # If false, the server enforces encryption for all premium usernames (cracked connections will fail to join). allow-premium-usernames: true # Fetch and apply the real premium player's skin textures to the cracked player's profile on join. # (Requires 'allow-premium-usernames' to be true). fetch-premium-skins: true