xLogin

Small mistake. Fixed.

xLogin v1.0.7 - The Ultimate Optimization & Bedrock Update

This update focuses on making xLogin incredibly smart, lightweight, and 100% dynamic. We rewrote the core security system, perfected Bedrock support, and made sure you never have to restart your server to apply config changes again!

Flawless Bedrock Support (Geyser/Floodgate)

Triple-Layer Detection:* The Bedrock auto-login system has been completely rewritten. It now uses a mathematical UUID version 0 check combined with the Floodgate API, ensuring Bedrock players bypass the login screen instantly and securely. Dynamic Toggle:* The geyser-support.auto-login-bedrock option is now checked in real-time. You can enable or disable Bedrock auto-login on the fly without restarting!

Unified & Dynamic Security System

Master Protection Check:* We removed redundant code and created a centralized isProtected() method. Performance is better than ever! Ultimate Interaction Blocker:* Unregistered players are now strictly prevented from opening physical menus (chests, crafting tables) or using items in their hands (like lobby compasses/clocks). Toggleable Blindness:* The blindness effect upon joining is now fully customizable. You can turn it on or off dynamically via protection.effects.blindness in the config.yml. Dynamic Captcha:* The Captcha system now correctly reads the captcha.enabled option from your config in real-time.

Smart Proxy & Network Handling

Real-Time Proxy Detection:* The plugin no longer locks the proxy state on startup. You can now toggle proxy-mode: true/false in your config, use /xlogin reload, and the /premium command will instantly enable or disable itself! Smart IP Tracking:* Removed the strict "Kick on different IP" feature that punished players with dynamic internet providers. Now, if a player's IP changes, they just need to enter their password normally, and the plugin will silently update their new IP in the database.

Administration & Quality of Life

Auto-Spawn Teleport:* Players are now automatically teleported to the designated login spawn (/xlogin setspawn) the exact millisecond they join the server, preventing them from falling into the void or glitching out. Fixed `/xlogin reload`: The reload command now properly reloads both* your config.yml and your language file (messages_es.yml / messages_en.yml) at the same time. Fixed Account Deletion:* Fixed an SQL parameter error when admins used /xlogin unregister <player>. Player Self-Unregister:* Added the /unregister command so regular non-premium players can delete their own accounts using their password. --- ⚠️ Note for Server Admins: Thanks to the new dynamic core, you can now change almost any setting in your config.yml and simply type /xlogin reload in the console to apply it instantly!

Addon for Velocity

* It is mandatory to download the normal version to your auth/lobby and configure it.

We've fixed several issues and improved the /premium system for proxy networks and Bedrock players.

Addon for BungeeCord = WaterFall

* It is mandatory to download the normal version to your auth/lobby and configure it.

xLogin v1.0.4 - The Ultimate Network & Security Update

We are thrilled to announce the biggest update to xLogin yet! This version brings massive improvements to server security, full proxy network support, Bedrock edition compatibility, and an entirely new suite of administration tools. Here is everything new in v1.0.4:

Smart Network & Proxy Integration (BungeeCord / Velocity)

Smart Proxy Detection:* xLogin now automatically detects if it is running on a standalone server or behind a Proxy (BungeeCord/Velocity). Network-Only Premium Mode: The `/premium` auto-login system now dynamically enables itself only* on proxy networks (to ensure 100% secure UUID verification) and safely disables itself on standalone servers. Auth-Lobby Redirection:* Added proxy-redirect to config.yml. You can now automatically send players to a target server (e.g., "Lobby") immediately after a successful login.

Bedrock Edition Support (Floodgate / Geyser)

Bedrock Auto-Login:* Added native support for GeyserMC/Floodgate. Bedrock players authenticated via Xbox Live can now automatically bypass the login screen. Fully Configurable:* The Bedrock bypass can be easily toggled on or off using the new geyser-support.auto-login-bedrock option in your config.yml.

Advanced Security & Asynchronous Logging

New Logging System:* Added a fully asynchronous LogManager. All successful logins, new registrations, failed password attempts, and admin actions are now safely recorded in plugins/xLogin/logs/security.log. Premium Name Protection:* Added prevent-premium-name-impersonation to the config. If a non-premium player tries to join using the username of an official Premium account, the plugin will automatically kick them to protect the account's identity. Thread-Safe Database:* Rewritten H2 database connection handling to prevent memory leaks and database corruption during high-traffic logins.

Massive Admin Command Expansion

We have completely revamped the /xlogin administration system! Admins now have ultimate control over the database directly from the game or console: `+` `/xlogin backup`*: Safely creates an instant backup of your database inside the /backups folder. `+` `/xlogin purge <days>`*: Cleans your database by deleting accounts inactive for a specified amount of days. `+` `/xlogin forcelogin <user>`*: Instantly forces a pending player into a logged-in state. `+` `/xlogin changeuuid <user> <uuid>`*: Easily update a player's UUID. `+` `/xlogin changepass <user> <pass>`*: Forcefully change a player's password. `+` `/xlogin verify <user>`*: Displays a detailed profile of a player (UUID, IP, Premium status, and Last Login). `+` `/xlogin unpremium <user>`*: Removes the premium status from a player's account. `+` Dynamic Help Menu:* The /xlogin help command now reads directly from your messages_en.yml or messages_es.yml, allowing you to translate or customize the admin help page!

General Fixes & Optimizations

* Updated pom.xml dependencies to the latest secure versions (MySQL Connector, BungeeCord Chat API). * Fixed movement glitching/stuttering for unregistered players in version 1.8.x. * Fixed an issue where the GUI Admin panel arrows would not paginate correctly. --- ⚠️ Important Note for Server Admins: Please make sure to regenerate or update your config.yml, messages_es.yml, and messages_en.yml files to access all the new features and translations included in this release!

v1.0.3 - The "Clean & Secure" Update

The biggest update yet! We have rebuilt the plugin's core to be lighter, removing unnecessary dependencies and improving global compatibility from 1.8.8 to 1.20.1+.

New Features

💎 Smart Premium System:* Added the /premium command with a confirmation system. Users can toggle their original Mojang status for automatic login (Auto-login). 🔐 Secure Password Change: New `/changepassword` command using BCrypt* encryption to update passwords securely. 🌈 Dynamic Hex Color Support:* Smart system that detects your server version. Use Hex colors (&#RRGGBB) on 1.16+ while maintaining classic compatibility on 1.8.8. 📂 100% Editable Messaging:* All messages are now organized by categories in messages_en.yml for full customization.

Improvements & Optimization

📦 Migration to Local H2:* Heavy MySQL and Email dependencies have been removed. The plugin is now "Plug & Play", storing everything in an ultra-fast local data.db database. ⚡ Asynchronous Performance:* All save and load operations are now asynchronous to ensure your server's TPS stays at 20.0. 🛡️ Hardened Security:* * Improved Blindness and movement lock upon joining. * Password change protection for premium users. * Status validation to prevent duplicate messages in commands.

Bug Fixes

✅ 1.8.8 Compatibility:* Fixed material errors (SKULL_ITEM vs PLAYER_HEAD) and sound issues that prevented the plugin from loading on older versions. ✅ Database Fix:* Optimized the connection to prevent H2 file corruption during server shutdowns. ✅ GUI Fix:* The admin panel now correctly displays player heads across all versions. ---

Made with ❤️ by xPlugins .

Version 1.0.2 - Critical Security Update

--- A critical security vulnerability has been fixed that allowed non-premium users to log in using the name of any premium account without being the owner. - Security Patch: The auto-login system for premium players no longer just checks if the name exists, but now correctly validates the player's session through the server's online-mode. - Anti-Impersonation: With this change, it is impossible for a non-premium player to impersonate a premium player.

All server administrators are advised to update to this version as soon as possible to protect their users' accounts.