peyajAuth v1.4 Changelog

peyajAuth v1.4 introduces updates to auto-login detection, Bedrock player compatibility, skin restoration, and API integrations for Spigot, Paper, and Folia (1.21+).

Key Features & Enhancements

• Hybrid Auto-Login: The plugin now intercepts the connection during the LoginStart phase to compare the client-provided UUID against Mojang's database. Premium clients will auto-login, while cracked clients using premium names will bypass encryption and be prompted for a password instead of being kicked with an "Invalid Session" error.
• Bedrock Temporary Player Fix: Resolved a critical "UnsupportedOperationException: getUniqueId is not supported for temporary players" by refactoring the Floodgate connection checks to use reflective Netty ChannelPipeline checks during early login stages.
• Bedrock Player Prefix Restoration: Fixed conflicts where external skin-rendering plugins (like SkinsRestorer) strip Bedrock name prefixes (e.g. ".") during join. The plugin caches and restores the prefixed player profile.
• Offline Premium Skin Retention: Added dynamic online skin fetching. If cracked/offline players connect using a premium username, the plugin will fetch their skin from Mojang session servers and apply it to their cracked profile automatically.
• Outage Fallback Policies: Added configurable behaviors during Mojang API outages (defaulting to kicking the player to protect their credentials).
• API Extensions: Added the "isBedrockPlayer(Player player)" method to the public PeyajAuthAPI interface.

Security Fixes

• Premium Account Impersonation Protection: Fixed a critical vulnerability where a cracked player joining with a premium username could be automatically logged in as the premium account owner due to the account cache incorrectly marking their connection as premium.
• Session Hijack Prevention: Session auto-login now verifies the connecting player's UUID matches the stored offline or premium UUID. Previously, only IP was checked — meaning an impersonator on the same network (LAN, VPN, shared WiFi) could inherit the real player's active session.
• Registration Race Condition Fix: Registration now uses atomic database inserts (INSERT IGNORE) instead of upserts (ON CONFLICT UPDATE) to prevent a race condition where a cracked impersonator's registration could silently overwrite an existing premium account's password hash and data.
• Brute Force Lock Scope Fix: Account-level brute force locks no longer block players at the pre-login stage. They are now enforced only at the /login command level, so a real premium player can still join and auto-login via the encryption handshake even if an impersonator triggered the account lockout by spamming wrong passwords.
• Correct Password Bypass on Account Lock: If an account is locked due to brute force attempts by an impersonator, the real account owner can still log in by entering the correct password. Wrong password attempts while locked will show the lock message, but correct passwords will always succeed and reset the lock. This ensures legitimate cracked players are never locked out of their own accounts.

Configuration Additions (premium.yml)

New settings inside premium.yml:

# Fallback behavior when Mojang API is offline
mojang-outage:
  # Options:
  # 'crack' - Treat premium players as cracked and force them to register/login with a password. (Safe)
  # 'kick' - Kick premium players when Mojang API is down. (Default)
  fallback: kick
  kick-message: "<red>Mojang authentication servers are currently down. Please try again later."

# Settings for cracked/offline players connecting with premium usernames
cracked-players:
  # Allow cracked players to connect using premium usernames.
  # If true, the server detects if the client UUID matches the premium UUID.
  # Real premium players will bypass login automatically, while cracked players will bypass encryption
  # and be prompted to register/login (preventing "Invalid Session" kicks).
  # If false, the server enforces encryption for all premium usernames (cracked connections will fail to join).
  allow-premium-usernames: true

  # Fetch and apply the real premium player's skin textures to the cracked player's profile on join.
  # (Requires 'allow-premium-usernames' to be true).
  fetch-premium-skins: true