🛡️ SecureLogin

Enterprise-Grade Password Authentication, Automatic Session Verification & Cryptographic Proxy Security
Developed by Chéngzé

SecureLogin is a modern, lightweight, and ultra-low-overhead authentication and security plugin designed for Paper / Purpur (1.21.x+) and proxy networks (BungeeCord, Waterfall, Velocity). Built for proxy-forwarded backends (online-mode=false behind a proxy), development environments, and servers requiring secondary password protection, SecureLogin secures player identities using modern cryptography with zero main-thread lag.

---

✨ Key Features

• 🚀 Automatic Mojang Session Verification: Players with verified Mojang sessions are authenticated automatically during the handshake, allowing seamless entry without requiring manual /register or /login commands.
• 📱 Native Geyser & Floodgate (Bedrock) Support: Zero-dependency detection for Floodgate (00000000-0000-0000-... Xbox Live UUIDs). Verified Bedrock sessions can automatically bypass password prompts (configurable), while prefix validation prevents username collisions between Java and Bedrock accounts.
• 🌐 Dual Deployment Architecture (2-in-1):
  • Standalone Mode (Single Server): Run SecureLoginBackend on a single Paper/Purpur server to provide in-game password authentication and session protection.
  • Proxy Auth-Lobby Mode (Network): Pair SecureLoginProxy + SecureLoginBackend to isolate unauthenticated connections in a dedicated Auth Lobby and automatically route verified players to your hub server.
• 🔐 HMAC-SHA256 Proxy-to-Backend Bridge: Every proxy-to-backend authentication state is signed with HMAC-SHA256, timestamped, and protected by a one-time cryptographic nonce cache—eliminating direct-backend port bypasses, packet spoofing, and replay attacks.
• ⚡ Ultra-Low Resource Usage: Engineered with asynchronous HikariCP database workers, cached MethodHandle reflection, and an idle-sleep ticker that consumes 0% CPU when all online players are authenticated.

!Preview

🔒 Security & Account Protection

• BCrypt Password Hashing: Industry-standard salted hashing (cost=12) ensures plaintext passwords are never stored or logged.
• Username Prefix & Symbol Filter: Prevents Floodgate prefix collisions (., -, +) across mixed Java/Bedrock environments.
• IP Registration Limiter: Mitigates automated bot attacks with a configurable maximum registration limit per IP address (max-accounts-per-ip).
• Smart IP Session Resumption: Returning players connecting from their verified IP address automatically resume their active session until expiration.
• Brute-Force Lockout: Configurable maximum failed login attempts and temporary account lockouts.

---

⌨️ Commands & Permissions

Command	Description	Permission
/register <pass> [confirm]	Register an account password	Default (All)
/login <password>	Authenticate your account	Default (All)
/logout	Safely end your active session	Default (All)
/changepassword <old> <new>	Change your account password & refresh sessions	Default (All)
/premium <status|link|unlink>	View or manage Mojang session verification	Default (All)
/auth reload	Reload configuration and message files	securelogin.reload
/auth unregister <player>	Delete a player's registration from the database	securelogin.unregister
/auth force-login <player>	Force-authenticate an online player (audit logged)	securelogin.forcelogin

Full administrative access node: securelogin.admin

---

🔌 Integrations & Storage

• Databases: SQLite (out-of-the-box default) and MySQL / MariaDB (HikariCP pooled).
• LuckPerms: Registers real-time contexts (securelogin:authenticated and securelogin:premium).
• PlaceholderAPI:
  • %securelogin_is_authenticated% (true / false)
  • %securelogin_account_type% (Premium / Password)
• UI & Formatting: Full Kyori Adventure MiniMessage support with customizable gradients, BossBar countdowns, ActionBars, and Titles.