WebSiteCaptcha v2.0.0

Overview

This release is a major update for WebSiteCaptcha, introducing a complete rewrite of the Limbo system, a new REST API for custom verification websites, improved security, and compatibility with the latest Minecraft versions. The internal architecture has been modernized to improve maintainability, performance, and long-term stability.

Limbo System

Complete Rewrite

• Rebuilt the entire Limbo system from scratch.
• Fully migrated from ProtocolLib to PacketEvents 8.x.
• Removed ProtocolLib as a dependency.
• Introduced a modular architecture with dedicated components for packet handling, restrictions, validation, scheduling, titles, action bars, chat filtering, damage handling, configuration, tab management, and session tracking.

Minecraft Compatibility

• Fixed the "Loading terrain..." issue on Minecraft 1.20.4+ and protocol 26.2 clients.
• Implemented the correct chunk loading sequence using the START_LOADING_CHUNKS game event.
• Added proper 5×5 chunk batching before player positioning.
• Fixed client crashes on newer Minecraft versions caused by invalid light data.
• Improved virtual world initialization and loading reliability.

Virtual Environment Improvements

• Implemented accurate frozen sky time matching the protocol implementation.
• Added support for DAY, NOON, SUNSET, NIGHT, MIDNIGHT, and custom time values.
• Improved weather synchronization and prevented Paper from overriding Limbo weather.
• Moved the virtual Limbo world to Y=310 to place players above the vanilla cloud layer.

Player Restrictions

• Prevent falling while inside Limbo.
• Lock player movement using server abilities.
• Keep players flying with zero movement speed.
• Improve packet filtering to maintain the virtual environment.

Validation and Bot Detection

• Added username validation using configurable regular expressions.
• Added client brand validation.
• Improved detection of invalid or automated clients.
• Enhanced packet-level protection for unverified players.

REST API

Added a secure REST API for integrating custom verification websites.

Endpoints

• POST /api/v1/verify
• GET /api/v1/session/{id}

Features

• Versioned REST API
• API key authentication
• Verification session management
• Example Next.js website template
• API documentation included

API Key Management

Added console-only management commands:

• /webcapture api create
• /webcapture api remove
• /webcapture api list

Implemented:

• ApiKeyManager
• Immutable ApiKey record
• Persistent api_key.json storage

Security

• Constant-time API secret comparison using MessageDigest.isEqual.
• Sliding window rate limiting.
• Automatic audit logging.
• 8 KB maximum request body size.
• Five-minute single-use verification sessions.
• Automatic cleanup of expired sessions.

Configuration

New Configuration Files

• api_config.yml

New Configuration Options

• Web_Type
• custom_url
• bind_address
• API host and port
• CORS configuration
• Rate limiting
• Limbo time presets
• Limbo weather presets
• Validation settings

Internal Improvements

• Removed legacy ProtocolLib implementation.
• Simplified configuration by removing obsolete options.
• Removed redundant Bukkit listeners in favor of packet-level handling.
• Cleaned up debug logging.
• Refactored imports and internal code organization.
• Improved overall maintainability and stability.

Breaking Changes

• ProtocolLib is no longer supported.
• PacketEvents 8.x is now required.
• Several legacy configuration options have been removed or renamed.
• Existing configurations may require updating to match the new format.

Notes

This release represents a significant architectural update to WebSiteCaptcha. Existing users should review the breaking changes and update their configuration before upgrading. The new REST API enables custom web verification workflows while the rewritten Limbo system provides improved compatibility, stability, and support for modern Minecraft versions.