FoliaLogin

1.1.0 – Two-factor authentication & spawn options

New

• Two-factor authentication (TOTP), works with Google Authenticator, Authy, Aegis, 2FAS…
  • /2fa add <password> shows a key (click to copy), then /2fa confirm <code> enables it
  • After /login, players with 2FA enter /2fa <code> (alias: /totp)
  • /2fa remove <code> to disable it, /authme resettotp <player> for admins (lost phone)
  • Brute-force protection: 5 tries, then kick + temporary lock (survives reconnects). Used codes can't be reused
• /authme setspawn: saves your position and the direction you're looking as the login spawn
• spawn.forceSpawnOnJoin: always put players at the spawn when they join
• spawn.spawnWorld: choose which world's spawn is used (default: main world)

Changes

• The login spawn now uses the main world, not the world the player logged out in
• Passwords and 2FA codes no longer appear in the console
• Login lockouts now survive reconnects (per account + IP), and /changepassword is rate limited
• /authme status now shows whether a player uses 2FA
• With premium.allowOfflineMode, accounts that have 2FA must log in with their password + code

Fixes

• With invalidateOnQuit and timeoutMinutes: 0, a player who never logged in could get an auto-login session

Upgrading

Replace the jar and restart. The database is upgraded automatically, and new options are added to config.yml and lang.yml without touching your settings. New permissions: authme.player.totp (everyone), authme.admin.setspawn and authme.admin.resettotp (op).