Accounts Login

Accounts Login

BlueMapWebChat 4.7.0 · Minecraft 1.18–26.2 · Java 17 baseline

10. Account Linking and Login

10.1 Link a Minecraft Account

Generate a link code in the web UI, then run in-game:

/bmchat auth <code>

Permission:

bluemapwebchat.auth

Related settings:

auth:
  enabled: true
  link-code-length: 6
  link-code-expire-seconds: 180
  link-code-cooldown-seconds: 3
  link-code-max-per-minute: 10

10.2 Password Login

Set a web password in-game:

/bmchat password <newPassword>

auth:
  password-login: true
  remember-session-days: 30

Passwords are stored as hashes, but HTTP login traffic is not encrypted. Use HTTPS for public deployments.

10.3 Roles

Available roles:

• USER
• MODERATOR
• ADMIN
• Unauthenticated guest access

Permission-based automatic administrator role:

auth:
  auto-admin-from-permission: true
  admin-permission: "bluemapwebchat.admin"

10.4 Local Administrator Accounts

Local web administrator accounts can exist without a linked Minecraft UUID.

admin:
  allow-local-admin-accounts: true

Commands:

/bmchat admin create <id>
/bmchat admin password <id> <password>
/bmchat admin role <id> <user|moderator|admin>

10.5 Session Management

/bmchat sessions
/bmchat revoke <username>

revoke removes active sessions and notifies connected browser clients that authentication expired.

11. Login and Connection Security

security:
  login-fail-limit: 5
  login-fail-window-seconds: 300
  login-lock-seconds: 600
  max-sse-connections-per-ip: 5
  max-sse-connections-total: 200

These settings provide temporary login lockout and per-IP/total SSE connection limits. A value of 0 disables the corresponding limit.

Optional administrator login IP restriction:

admin:
  allow-admin-login-from: []

An empty list allows all addresses. Public administrator accounts should use HTTPS and strong passwords.