VeloAuth

<p align="center"> <img src="https://cdn.modrinth.com/data/cached_images/a31eec688d48cffe2770bd961e5d134c71b8b662.png" alt="VeloAuth"> </p> # VeloAuth (https://img.shields.io/badge/Modrinth-00AF5C?style=for-the-badge&logo=modrinth&logoColor=white)](https://modrinth.com/plugin/veloauth) (https://img.shields.io/badge/Discord-5865F2?style=for-the-badge&logo=discord&logoColor=white)](https://discord.gg/e2RkPbc3ZR) (https://img.shields.io/github/license/rafalohaki/veloauth?style=for-the-badge)](https://github.com/rafalohaki/VeloAuth/blob/main/LICENSE) (https://img.shields.io/badge/bStats-Tracked-blue?style=for-the-badge)](https://bstats.org/plugin/velocity/VeloAuth) (https://img.shields.io/badge/Ko--fi-FF5E5B?style=for-the-badge&logo=kofi&logoColor=white)](https://ko-fi.com/rafalo) **Complete Velocity authentication plugin** with intelligent nickname protection, premium auto-login, secure offline player management, and optional self-contained embedded limbo. ## What is VeloAuth? VeloAuth is a comprehensive authentication system for Velocity proxy that handles all player authorization before they reach your backend servers. It includes a loopback-only embedded limbo while maintaining full compatibility with existing external limbo servers, all while protecting nickname ownership through intelligent conflict resolution. ## Live test server Want to see VeloAuth in action? **(https://2b2t.pl)** runs the plugin in production — join the server to test premium auto-login, offline registration and nickname protection on a live network. ## Key Features - 🔒 **Intelligent Nickname Protection** - Premium nicknames are reserved unless already registered by cracked players. - ⚡ **Premium Auto-Login** - Mojang account owners skip password entry after session verification; auth/limbo passthrough is an opt-in bypass. - 🔄 **Automatic Nickname Change Detection** - Detects when a premium player renames their Mojang account and updates the database record automatically. - 🛡️ **Secure Offline Auth** - BCrypt password hashing, brute-force protection, and atomic first-owner registration enforced by the database. - 📱 **Optional Floodgate Support** - Bedrock and linked Floodgate accounts are detected before Mojang resolution; only UUIDs confirmed by Floodgate can bypass the auth server. - 🧩 **Optional Self-Contained Limbo** - Use the built-in 1.8-base limbo with a reviewed, checksum-pinned ViaVersion runtime, or keep using an external limbo (NanoLimbo, etc.). - 🗺️ **Forced Hosts Support** - Players connect via custom domains (e.g., `pvp.server.com`) and are properly routed to their intended server *after* authentication. - 🚫 **Smart Command Hiding** - Authentication commands (`/login`, `/register`) are hidden while authorization is active; expired sessions expose them again. - 🚀 **High Performance** - Bounded three-layer premium cache (in-memory → DB → Mojang/Ashcon API), virtual threads (Java 21), and zero blocking on Velocity event loops. - 🔐 **Optional 2FA (TOTP)** - Opt-in RFC 6238 second factor compatible with Google Authenticator, Authy, Aegis. See (https://github.com/rafalohaki/VeloAuth/blob/main/2FA.md) for the operator handbook. - 🔄 **Conflict Resolution** - Smart handling of premium/cracked nickname conflicts with `/vauth conflicts`. - 📊 **Admin & Diagnostic Tools** - Health checks, statistics, and 1-click sanitized diagnostic reports via `/vauth report` (mclo.gs). - 🗄️ **Multi-Database** - MySQL, PostgreSQL, H2, and SQLite with HikariCP connection pooling. - 🌍 **17 Languages & HEX Formatting** - EN, PL, DE, FR, RU, TR, SI, FI, ZH_CN, ZH_HK, JA, HI, VI, KO, TH, ID, PT_BR with full RGB/HEX color support. - 🔄 **LimboAuth Compatible** - 100% database schema compatibility with automatic, additive in-place migrations. - 📢 **Discord Alerts** - Webhook notifications for security anomalies and resolver failure spikes with automated retry logic. ## When to use VeloAuth - **You run a Velocity proxy** with one or more backend servers and need authentication at the proxy layer (not per-backend). - **You accept both premium and cracked players** and need automatic, fail-secure routing — premium players skip `/login`, cracked players go through BCrypt-hashed registration. - **You already use LimboAuth** and want to migrate without losing data — VeloAuth reads and upgrades the same schema seamlessly. - **You want high performance** — premium status is resolved through a three-layer cache without blocking proxy event loops. If you only run a single backend server (Paper/Spigot/Folia) without a proxy, use a backend-side auth plugin instead. ## Operating Profiles Choose how strict nickname protection should be in `plugins/veloauth/config.yml`: ### Profile 1 — **Mixed strict** (default, recommended) ```yaml premium: check-enabled: true allow-cracked-on-premium-nicks: false bypass-auth-server: false ``` * **What you get:** Premium playe