peyajAuth v1.5 - Changelog

peyajAuth v1.5 is a major release featuring a complete overhaul of the packet interception layer, smooth gameplay restrictions, and significant security hardening.

---

Key Highlights

ProtocolLib Removal and PacketEvents Migration

• Zero-Dependency Standalone Build: Migrated the entire packet interception layer from ProtocolLib to PacketEvents 2.12.0.
• Reduced Maintenance Overhead: Eliminates the risk of startup crashes during minor Minecraft protocol changes.
• Fully Shaded: PacketEvents is now shaded and relocated inside peyajAuth.jar — ProtocolLib is no longer required.

Smooth Freeze Mechanics (No More Jitter!)

• Horizontal Walk/Fly Speed Lock: On join, unauthenticated players now have their walking and flying speeds locked to 0.0f. This blocks the client-side physics engine from attempting movement, completely eliminating horizontal rubber-banding.
• Horizontal-Only Position Lock: Position resets now lock X and Z coordinates only. Target Y coordinates are preserved, allowing gravity, falling, and jumping to simulate smoothly without server-reset twitching.
• Speed Cache Restorations: Original player speeds are recorded and restored seamlessly upon successful authentication (safely falling back to default values).

Strict Premium Verification and Takeover Protection

• Strict Online Mode Enforcement: Any player connecting with a username marked as isPremium in the database is strictly forced to complete Mojang's cryptographic encryption handshake.
• Anti-Spoofing and Bypass Block: Premium players can no longer fall back to cracked mode (even if allow-premium-usernames is enabled) or bypass verification.
• Outage Takeover Protection: If Mojang authentication servers go down, any connection attempt for a registered premium account is kicked immediately rather than falling back to cracked mode, preventing takeover attempts while authentication is offline.
• Decryption Hardening: If the client sends a malformed or tampered encryption response, the connection is instantly disconnected rather than falling back to cracked.

Secure Proxy Tracking

• Unique Netty Channel Keys: Replaced IP-based state tracking with unique Netty Channel ID long text hashes (channel.id().asLongText()). This uniquely identifies the exact TCP socket connection, preventing state collisions or state poisoning when running behind BungeeCord/Velocity proxies where ports are recycled.

Username Format Validation

• SSRF and Malformed Request Protection: Added regex-based username validation (^[a-zA-Z0-9_]{2,16}$) immediately after receiving the LoginStart packet. Connections with malformed usernames are dropped before triggering any Mojang API or database operations.

---

Internal Refactoring and Fixes

• RSA Key Hardening: Ephemeral RSA keys generated on server startup have been upgraded from 1024 to 2048 bits.