peyajAuth

This update is for the transition from ProtocolLib to PacketEvents

peyajAuth v1.4 Changelog Authentication improvements, Bedrock compatibility, security fixes, and new API features for Spigot, Paper & Folia (1.21+). ━━━━━━━━━━━━━━━━━━━━ ✦ ━━━━━━━━━━━━━━━━━━━━​ Key Features & Enhancements · Hybrid Auto-Login The plugin now intercepts the connection during the LoginStart phase and compares the client-provided UUID against Mojang's authentication servers. Premium players are automatically logged in, while cracked players using premium usernames bypass encryption and are prompted to register/login instead of receiving an "Invalid Session" error. · Bedrock Temporary Player Fix Resolved the "UnsupportedOperationException: getUniqueId is not supported for temporary players" issue by replacing early Floodgate player checks with reflective Netty ChannelPipeline detection. · Bedrock Prefix Restoration Fixed compatibility with plugins such as SkinsRestorer where Bedrock prefixes (for example ".") could be removed during login. peyajAuth now restores the original Bedrock player profile. · Premium Skin Support for Offline Players Cracked/offline players joining with premium usernames can now automatically receive the real premium player's skin by downloading textures from Mojang's session servers. · Mojang Outage Policies Added configurable fallback behaviors for Mojang authentication outages, allowing servers to either kick players or temporarily treat premium accounts as cracked. · New API Method Added: Code (Text): boolean isBedrockPlayer(Player player); to the public PeyajAuthAPI. ━━━━━━━━━━━━━━━━━━━━ ✦ ━━━━━━━━━━━━━━━━━━━━​ Security Improvements · Premium Account Impersonation Protection Fixed a vulnerability where cracked players using premium usernames could incorrectly inherit premium authentication from cached login data. · UUID Session Verification Session auto-login now validates both the player's UUID and IP address, preventing session hijacking on shared networks, LANs, or VPNs. · Registration Race Condition Fix Registration now uses atomic INSERT IGNORE operations instead of upserts, preventing cracked impersonators from overwriting existing premium account data. · Improved Brute Force Protection Account lockouts are now enforced only when executing /login, allowing legitimate premium players to continue authenticating through Mojang. · Correct Password Always Works Even if an account is temporarily locked because of failed attempts, entering the correct password immediately authenticates the legitimate owner and clears the lock. ━━━━━━━━━━━━━━━━━━━━ ✦ ━━━━━━━━━━━━━━━━━━━━​ New Configuration Options (premium.yml) Code (Text): # Fallback behavior when Mojang API is offline mojang-outage: # Options: # 'crack' - Treat premium players as cracked and require login/register. # 'kick' - Kick premium players while Mojang is unavailable. (Default) fallback: kick kick-message: "<red>Mojang authentication servers are currently down. Please try again later." # Settings for cracked/offline players using premium usernames cracked-players: # Allow cracked players to connect using premium usernames. # Premium users authenticate automatically while cracked users # are prompted to register/login instead of receiving # an Invalid Session error. allow-premium-usernames: true # Download and apply the premium player's skin. # Requires allow-premium-usernames to be enabled. fetch-premium-skins: true ━━━━━━━━━━━━━━━━━━━━ ✦ ━━━━━━━━━━━━━━━━━━━━ Thank You for Using peyajAuth! This update focuses on stronger authentication, improved compatibility with Bedrock and premium accounts, and enhanced security for both online-mode and offline-mode servers. We appreciate your continued support and feedback! ​