JustEnoughSkins

# JustEnoughSkins

JustEnoughSkins is a Velocity plugin that checks the player's skin `textures` property during the profile request stage. Textures with valid Mojang signatures are kept as is, while unsigned or invalid textures are re-signed through the MineSkin API and cached to avoid repeated requests.

## Configuration File

On first startup, the plugin creates:

```text plugins/justenoughskins/config.toml ```

Default configuration example:

```toml # Enables debug logging. # false: recommended for normal use. # true: logs skin URLs, cache keys, signing time, and other details for troubleshooting. Debug = false

# MineSkin API endpoint. # By default, the plugin requests https://api.mineskin.org/v2/generate. MineSkinApi = "https://api.mineskin.org"

# MineSkin API key. # Register at https://account.mineskin.org/ to get one. # Empty value still works, but requests may hit stricter rate limits. # A valid key usually provides more stable quota and permissions. # Using Cape requires a key with the required permission. ApiKey = ""

# Maximum time to wait for signing during the profile request, in seconds. # 3. 0: wait up to 3 seconds, making the new skin more likely to apply on first login. # 1. 0: wait less and prioritize login speed; on timeout, the current request will not wait for the signing result. # <= 0: run the full signing flow synchronously with no background timeout. Slow or unavailable MineSkin service can noticeably delay login. WaitingTime = 3. 0

# Cape parameter sent during skin generation. # Empty value: do not request a cape. # Non-empty value: send it as the cape field to MineSkin. # The MineSkin API key must support the requested cape capability, otherwise generation may fail. Cape = ""

# URL schemes allowed for original skin URLs that need re-signing. # By default, only https is allowed. AllowedSchemes = ["https"]

# URL domains allowed for original skin URLs that need re-signing. # The plugin downloads the skin and sends it to MineSkin only when both the scheme and domain are allowed. # Domains must match exactly, for example ["textures.minecraft.net"]. # Empty list means no unsigned or invalid external skin URL will be re-signed. AllowedDomains = [] ```

## URL Allowlist

Textures with valid Mojang signatures are still accepted as is. The allowlist is checked only when a texture is unsigned or has an invalid signature and needs to be re-signed.

The original skin URL must satisfy both rules:

• Its scheme is listed in `AllowedSchemes`.
• Its domain is listed in `AllowedDomains`.

URLs outside the allowlist are rejected. They are not downloaded and are not submitted to MineSkin.

The plugin calculates a cache key from the original skin URL and stores MineSkin's signed texture result under:

```text plugins/justenoughskins/cache/ ```

When the same skin URL appears again, the plugin uses the cache first to reduce MineSkin requests and login latency.

## Reloading

After a Velocity proxy reload, the plugin reloads `config.toml`. Existing cache entries are not cleared automatically.