v1.7.0 — the login prompt stops lying, and your server sees real IPs

Everything in this release came from someone actually playing on a server in front of it, not from a test suite. The tests were green throughout.

Waiting at the login prompt no longer looks broken

Holding an unauthenticated player was never the problem — the server genuinely never saw them move. Everything they could see was wrong.

• Minecraft predicts movement on the client and only corrects it when the server disagrees, so a held player walked around their own screen and then snapped back.
• Their real coordinates sat on the HUD for anyone watching, before they had proved they owned the name.
• Mobs went on hitting them while they read the prompt, and they could die at it.
• The prompt was one line of chat, which scrolls away while you are in your inventory.
• The commands it told them to type rendered red, because the backend has never heard of them — the firewall answers first.

Now: the client is told where it is, repeatedly, at the origin rather than at their real position, and put back exactly where the server has them the moment they log in. The prompt goes across the middle of the screen as well as into chat. The words work without a slash, so nothing renders as an error. Someone registering is offered the premium route, which until now could only be found from the far side of the prompt asking for a password.

Every line of it is configurable, the on-screen title included.

Damage is the one this cannot fix outright: a firewall in front of a server cannot stop a creeper. What it can do is notice — a held player who starts taking damage is disconnected before they die. A kick costs a reconnect; a death costs an inventory.

Your server can finally see who is connecting

Every player in the server log was 127.0.0.1. All of them, always — so banning an IP there banned the proxy, which is everyone.

Pick PROXY protocol or BungeeCord-style forwarding per server, on the Servers page. The offline UUID that BungeeCord forwarding carries is checked against real UUIDs from a live server's own log; getting that wrong would not look like a bug, it would look like everyone's account being wiped.

Neither is on by default and neither is safe alone — your backend has to expect it, and its port has to stay on loopback. The Security check page already tests exactly that.

A Players section

Pick a server and see everyone it knows: who registered and when, when they were last seen, from where, and the itemised reasons that address looks suspicious — the same weights the log prints. Open one and their whole history is there.

Five actions, each asking first: forget trusted addresses, reset a password, lock a name to its Minecraft account, unlock it, remove it.

Players can also change their own password in game with changepassword <current> <new>. The current one is required even from a trusted address, because a household shares an address.

New Minecraft versions, without you doing anything

A version this build has never seen is now learned at runtime. What makes that safe is the refusal, not the fetching: before a single learned table is believed, the same source has to reproduce every table this build generated from Mojang's own data generator — all twelve, exactly. One disagreement anywhere and the whole fetch is abandoned.

Malformed packets, refused before the server parses them

What PacketFixer-style plugins do, a step earlier — a plugin runs after the decoder, and the decoder is where the damage happens.

Also fixed

• Connecting by raw IP no longer counts as announcing a foreign domain, and the count is now a window rather than a tally. Previously a server's own owner scored full bot weight on every join they ever made, with no way back short of a restart.
• Somebody who logged off wounded is no longer kicked on sight and told something attacked them. Damage is a fall, not a level.
• A save can no longer silently switch IP forwarding back off — caught by its own regression test before it shipped.

Honest about the rest

A long list was asked for: an Identity Engine, a DDoS engine, a Sonar/LimboFilter-class bot engine, an anti-cheat. docs/requested-features.md goes through all of it, item by item — done, added, feasible-but-not-built, or not possible from a proxy, with the reason each time.

The short version: a verification limbo means implementing enough of a Minecraft server to hold a client in a world, per version. An anti-cheat cannot see the world from here — flight needs to know whether there is a block underneath somebody. Alt-account correlation is refused on purpose, because "these names used this address" is equally true of a family and a games café.

---

594 tests. Windows 10/11, x64. Nothing to install first — the .NET runtime is bundled.