Logging in twice and duplicating items

[inklit]

Explanation of the problem:
If you connect at the exact same time on two clients, you are able to login twice on the same account. This causes all sorts of issues regarding movement, inventories, and other weird shenanigans.
The primary concern here is item duplication, you are able to login on two accounts and drop both inventories to duplicate items.

Procedure for testing:

1. Start a SpongeForge 1755 server with Forge 1902 (No other versions tested)
2. Set the server to offline mode (only for testing, since sessions don't really work well with two clients, it also works in online mode with hackery)
3. Open two Minecraft clients
4. Line up both clients similar to this with your test server selected: http://i.imgur.com/6n5uEUS.png
5. Very quickly click Join Server on both clients.
6. If done fast enough, both of your clients will join the server at the same time without being kicked. It will look something like this: http://i.imgur.com/2rvs3hX.png

Additional Information:
This was tested with just SpongeForge 1755 and Forge 1902. No plugins or mods.

In the console, it will look something like this:
http://i.imgur.com/NArbMMu.png

While testing this, I managed to make the server throw an error if the timing is not perfect:

[20:44:00] [Netty Epoll Server IO #2/WARN] [io.netty.util.concurrent.DefaultPromise]: An exception was thrown by net.minecraft.network.NetHandlerPlayServer$1.operationComplete()
io.netty.util.concurrent.BlockingOperationException: DefaultChannelPromise@4220e83d(uncancellable)
        at io.netty.util.concurrent.DefaultPromise.checkDeadLock(DefaultPromise.java:390) ~[DefaultPromise.class:?]
        at io.netty.channel.DefaultChannelPromise.checkDeadLock(DefaultChannelPromise.java:157) ~[DefaultChannelPromise.class:?]
        at io.netty.util.concurrent.DefaultPromise.awaitUninterruptibly(DefaultPromise.java:283) ~[DefaultPromise.class:?]
        at io.netty.channel.DefaultChannelPromise.awaitUninterruptibly(DefaultChannelPromise.java:135) ~[DefaultChannelPromise.class:?]
        at io.netty.channel.DefaultChannelPromise.awaitUninterruptibly(DefaultChannelPromise.java:28) ~[DefaultChannelPromise.class:?]
        at net.minecraft.network.NetworkManager.func_150718_a(NetworkManager.java:304) ~[ek.class:?]
        at net.minecraft.network.NetHandlerPlayServer$1.operationComplete(NetHandlerPlayServer.java:172) ~[lm$1.class:?]
        at io.netty.util.concurrent.DefaultPromise.notifyListener0(DefaultPromise.java:680) [DefaultPromise.class:?]
        at io.netty.util.concurrent.DefaultPromise.notifyListeners0(DefaultPromise.java:603) [DefaultPromise.class:?]
        at io.netty.util.concurrent.DefaultPromise.notifyListeners(DefaultPromise.java:563) [DefaultPromise.class:?]
        at io.netty.util.concurrent.DefaultPromise.trySuccess(DefaultPromise.java:406) [DefaultPromise.class:?]
        at io.netty.channel.DefaultChannelPromise.trySuccess(DefaultChannelPromise.java:82) [DefaultChannelPromise.class:?]
        at io.netty.channel.ChannelOutboundBuffer.safeSuccess(ChannelOutboundBuffer.java:523) [ChannelOutboundBuffer.class:?]
        at io.netty.channel.ChannelOutboundBuffer.remove(ChannelOutboundBuffer.java:247) [ChannelOutboundBuffer.class:?]
        at io.netty.channel.ChannelOutboundBuffer.removeBytes(ChannelOutboundBuffer.java:322) [ChannelOutboundBuffer.class:?]
        at io.netty.channel.epoll.EpollSocketChannel.writeBytesMultiple(EpollSocketChannel.java:212) [EpollSocketChannel.class:?]
        at io.netty.channel.epoll.EpollSocketChannel.doWriteMultiple(EpollSocketChannel.java:364) [EpollSocketChannel.class:?]
        at io.netty.channel.epoll.EpollSocketChannel.doWrite(EpollSocketChannel.java:317) [EpollSocketChannel.class:?]
        at io.netty.channel.AbstractChannel$AbstractUnsafe.flush0(AbstractChannel.java:707) [AbstractChannel$AbstractUnsafe.class:?]
        at io.netty.channel.epoll.AbstractEpollChannel$AbstractEpollUnsafe.epollOutReady(AbstractEpollChannel.java:248) [AbstractEpollChannel$AbstractEpollUnsafe.class:?]
        at io.netty.channel.epoll.EpollSocketChannel$EpollSocketUnsafe.epollOutReady(EpollSocketChannel.java:623) [EpollSocketChannel$EpollSocketUnsafe.class:?]
        at io.netty.channel.epoll.EpollEventLoop.processReady(EpollEventLoop.java:322) [EpollEventLoop.class:?]
        at io.netty.channel.epoll.EpollEventLoop.run(EpollEventLoop.java:264) [EpollEventLoop.class:?]
        at io.netty.util.concurrent.SingleThreadEventExecutor$2.run(SingleThreadEventExecutor.java:116) [SingleThreadEventExecutor$2.class:?]
        at java.lang.Thread.run(Thread.java:745) [?:1.8.0_91]
[20:44:00] [Server thread/INFO]: BTC lost connection: Disconnected

This error may not be very relevant to the issue at hand here, but maybe somebody will find it useful.

[inklit]

I asked a friend of mine to code a hotfix for this bug.
This is by no means a solution to the problem but it prevents the problem from causing any serious issues while we wait for Forge to fix this up stream.
I figured some server owners out there might find this useful.

http://switchcraft.pw/logdupepatch-1.0-snapshot.jar is the download link. It is for 1.8.9 API 4.2.0
https://gist.github.com/inklit/c208a36bd5901d56db13ec9b0add94a1 is the link to the source code.

Use at your own risk, this code might crash your server, prevent players from logging in, burn your house down, or murder kittens (but it theoretically shouldn't do any of those things).

[inklit]

The plugin author has created a small update for a performance improvement.

http://switchcraft.pw/logdupepatch-2.0-snapshot.jar is the download link.
https://gist.github.com/inklit/c208a36bd5901d56db13ec9b0add94a1#gistcomment-1888014 is the source code.

[Zidane]

Given that this is in offline-mode, is this just an issue with Forge @inklit . Is this still a problem?

[bloodmc]

Closing as this should be addressed in Forge.