VeloAuth
Плагин VeloAuth для Velocity - это система аутентификации с автовходом для премиум-игроков и регистрацией/логином для пиратов. Защищает ники, шифрует пароли BCrypt и работает с любой limbo-сервером.
Список изменений
VeloAuth 1.6.0
🔒 Security fix. Premium players connecting during the startup window — after Velocity opens
its port but before VeloAuth finishes initializing — were let through with no premium check, and
got an offline UUID on proxies with online-mode = false. The window reopened on every restart
and could be timed deliberately: treat it as a name-sniping vector. Queued logins now go through
the full PreLogin pipeline, and are denied if it isn't ready.
⏱️ Rate limits for premium lookups. A join wave could multiply into far more upstream requests
than lookups, cross Mojang's limit, and turn its 429s into a proxy-wide login outage. New ceilings
under premium.resolver: mojang-requests-per-minute (120), ashcon- / wpme-requests-per-minute
(60), rate-limit-max-wait-ms (1000). Set to 0 to disable.
Upgrading. Full proxy restart required.