Using custom authentication and session server

[Javfix]

Hello!! We cannot go to an unofficial server. To start, you need to use your own parameters --session, --uid, --access Token . How to replace on your own? Tried to edit the file SessionCache.db, but failed to open it. Sorry for my English.

[ORelio]

Are you sure your server is not requiring a modded client? Because even started with these arguments, the official client would try to use the official session servers when joining the server.

[Javfix]

The server uses its own launcher with its authorization. And uses its own session, uid, Access Token. I think if you pass these parameters to Minecraft-Console-Client then I get to go to the server.

[ORelio]

I'm not sure that would work, but try using the latest development build while making sure disk session cache is enabled? It should create a SessionCache.ini in which you can set your own uuid and access token. However, I think that the official session servers won't accept this unless they originate from an official Minecraft account.

[Javfix]

I have successfully replaced the uuid and sessionID that way.

But it didn't work. Having studied the code in detail, I realized that uuid and sessionID is sent to the server "https://sessionserver.mojang.com/session/minecraft/join"

Then I checked the POST and Get requests of the client that uses my server.

Then I tried to replace the server with "http://ex-server.ru/exUUIDAuth.php?action=join"

But the Post request is not sent, I suspect that this is due to the fact that "http://ex-server.ru" uses http.
Am I right or wrong? How to send an http request to http://ex-server.ru/exUUIDAuth.php?action=join?

[ORelio]

Well, if the server implements their own login and session servers, that's not a surprise if MCC cannot handle it and I can't support and implement every custom authentication schemes.

However, seems you are able to edit & recompile MCC by yourself, then you're almost there. As you guessed, MCC will try to start a TLS session for issuing the request over HTTPS, so that won't work if your server only supports HTTP. If you absolutely need to use HTTP with your custom session server, you should be able to do so by editing the doHTTPSRequest method.

Replace the this part:

TcpClient client = ProxyHandler.newTcpClient(host, 443, true);
SslStream stream = new SslStream(client.GetStream());
stream.AuthenticateAsClient(host);
stream.Write(Encoding.ASCII.GetBytes(String.Join("\r\n", headers.ToArray())));
System.IO.StreamReader sr = new System.IO.StreamReader(stream);

with the following:

TcpClient client = ProxyHandler.newTcpClient(host, 80, true);
client.Write(Encoding.ASCII.GetBytes(String.Join("\r\n", headers.ToArray())));
System.IO.StreamReader sr = new System.IO.StreamReader(client.GetStream());

The request should skip TLS and do plain HTTP. Of course, using HTTP is not recommended as your credentials/session tokens are sent unencrypted over the network, which is very insecure and can lead to credentials theft. But if your session server is compliant with the Minecraft authentication protocol, then it should work. 🙂

[Javfix]

The replacement of the code I get the error CS1061. I don't know C# and don't understand this error, can't fix.

[ORelio]

My bad.

TcpClient client = ProxyHandler.newTcpClient(host, 80, true);
byte[] request = Encoding.ASCII.GetBytes(String.Join("\r\n", headers.ToArray()));
client.GetStream().Write(request, 0, request.Length);
System.IO.StreamReader sr = new System.IO.StreamReader(client.GetStream());

[Javfix]

At the beginning of the POST request was not sent, making small corrections, the POST request successfully went and received a response.

The response from the server POST.

When you try to log on to the server, the client hangs on the string Checking Session... for 45 seconds, the feeling that he is waiting for something.

I noticed that the response from the server ex-server.ru and mojang.com much different.
Does the client use a response from the server? The client may not be using the server response correctly. Also in the client from my server the additional get request is used, I don't know precisely it participates in connection or not.

The response from the server GET.

[ORelio]

There is no GET in Mojang authentication protocol so they probably put further changes in their modified version of the authentication protocol. You might want to adapt SessionCheck to do the request(s) you want, since you have a sample request & response in your screenshot. You have DoHTTPSGet and DoHTTPSPost available for that, you can edit headers as required, and you already have the modified DoHTTPSRequest which skips TLS and sends a plain HTTP request. 🙂

[TheSnoozer]

As OReilo mentioned I don't think this will ever be implemented. Closing as won't fix.