MyLogin v1.3.0

New Features

• Added username case protection for offline-mode servers
• Added duplicate session protection
• Added username collision scanner
• Added /mylogin checkplayer
• Added /mylogin stats
• Added /mylogin scannamecollisions

Security Improvements

• Prevents players from registering alternate username capitalization when case enforcement is enabled
• Prevents duplicate active sessions using the same username
• Added startup username collision detection and reporting
• Improved login session cleanup on disconnect, kick, and shutdown

Migration Improvements

• Added migration overwrite protection
• Existing MyLogin accounts are no longer overwritten by default
• Added migration logging for migrated, skipped, and overwritten accounts
• Added migration.skip-existing-users configuration option

Configuration Improvements

• Improved configuration migration handling
• Improved reload behavior
• Added username security configuration options

New Configuration Options

security:
  enforce-name-case: false
  scan-name-collisions-on-startup: true
  block-duplicate-sessions: true

migration:
  skip-existing-users: true

Compatibility

• Java 21+
• Paper 1.21.x
• Tested on Paper 1.21.11
• Compatible with modern Paper builds using the Bukkit/Paper API

Migration From Passky

Supports migration of existing Passky SHA-256 password data without requiring players to register again.

Notes

This release focuses on account protection, offline-mode security, migration safety, and administrative tooling.

⚠️ Important Upgrade Notice

Username Case Protection

If your server previously allowed multiple usernames that differ only by capitalization, you must manually clean up duplicate entries before enabling username case protection.

Example duplicates:

SkyBuilder
SKYBUILDER
sKyBuIlDeR

Choose the account that should remain as the primary username and remove the duplicate entries from:

plugins/MyLogin/data/users.yml

Example:

Keep:
SkyBuilder

Delete:
SKYBUILDER
sKyBuIlDeR

After cleanup:

1. Save users.yml
2. Restart the server
3. Run /mylogin scannamecollisions
4. Verify that no collisions are reported

Failure to clean duplicate usernames may cause:

• Login protection conflicts
• Inventory restore conflicts
• Economy account duplication
• Permission duplication
• Claim ownership conflicts
• inventory Backup and restore lookup issues

The username you choose to keep becomes the permanent canonical username that players must use when connecting when username case protection is enabled.

Existing Server Recommendation

Before enabling:

security:
  enforce-name-case: true

Review:

plugins/MyLogin/data/name-collision-log.yml

Resolve all reported collisions and keep only one username variant for each player.

This step is strongly recommended for existing offline-mode servers upgrading from older authentication systems.

Related Plugins

Servers using plugins such as:

• AxInventoryRestore
• LuckPerms
• Economy plugins
• Claim plugins
• Backup plugins

should verify that all player data is associated with the same username capitalization before enabling username case protection.