rLogin v1.1.3

Full Changelog: v1.1.2...v1.1.3

rLogin v1.1.2

Full Changelog: v1.1.1...v1.1.2

rLogin 1.1.1

One download, rLogin-1.1.1.jar, for both Paper/Folia and Velocity.

New

general.auth-mode — say who your server is for, instead of leaving it to be inferred.

auto	Premium join without typing anything, everyone else with a password. The default, and what 1.1.0 did.
online	Premium only. Anyone Mojang won't vouch for is refused at the door.
offline	Passwords only. Nothing is checked against Mojang — the one mode that needs no PacketEvents on a standalone server.

limbo.login-timeout-seconds (default 60) — disconnect a player who never logs in. A connection parked at the login prompt still holds a player slot, which is all it takes to fill a server without owning an account. 0 keeps the old behaviour.

Metrics are live. bStats was wired in from the start with the plugin id left at zero, so it dutifully did nothing. Both halves now report under their own id — a network of six backends and one proxy is one proxy install. Opt out with metrics.bstats, which the proxy config now has too.

Fixed

rLogin no longer starts into a setup that serves nobody. With online-mode on, the server — or Velocity — turns away every player without a Minecraft account before any plugin is consulted. On auth-mode: auto or offline, that is the entire audience the plugin was installed for, while everything still looks healthy. Both sides now refuse every connection and explain why, in the console and on the kick screen. auth-mode: online is the exception: there, online-mode=true is the correct setting.

The premium greeting appears once per connection, not once per server. Every backend sees an ordinary join, so a player hopping between four servers was told four times that their premium account had been detected. Only the proxy can tell a fresh connection from a hop, so it now says which, and the backend waits for the answer.

Also

• Velocity 4.x works, alongside 3.x. No code change was needed — every API rLogin touches has the same signature in both.
• Two new messages, translated across all 17 languages.
• The repositories moved to pyrelightmc. The update checker followed; older versions will keep checking the old path.
• Documentation rewritten from the source at https://pyrelight.mintlify.app/rlogin/introduction, including a correction worth knowing about: the old instructions told you to set online-mode = true in velocity.toml. That is the one value that stops rLogin working.

Upgrading from 1.1.0

Drop the jar in and restart. New settings are appended to your config.yml automatically, with your values and comments kept.

Check online-mode before you do. If it is on and you are not running auth-mode: online, rLogin will refuse connections until you turn it off — which is the bug it is reporting, not a new restriction.

rLogin 1.1.0

Premium auto-login now turns itself on wherever it is needed. There is no setting to find, and no setting to forget.

The change that matters

1.0.0 shipped standalone premium auto-login off by default, behind premium.standalone-hybrid-mode. On a real public server nobody found it: premium players were asked for a password and the feature looked broken. A setting whose only correct value is "whatever matches your setup" is not a setting.

It is gone. rLogin reads online-mode, paper-global.yml and spigot.yml, works out whether anything else verifies your players, and verifies them itself exactly when nothing does.

Where it verifies, PacketEvents is required. A standalone server without it now refuses every connection, with a banner in the console and an explanation on the player's disconnect screen. That is deliberate: switching the plugin off instead would leave an offline-mode server with no authentication at all, where anyone could join under any name, including yours. Refusing is the safe failure.

PacketEvents stays a separate download because it is GPL-3.0 and rLogin is MIT — bundling it would relicense this plugin.

Your config survives upgrades

Until now the file was only written when missing, so a server that already had one never saw a new setting. It worked on the default: invisible, undocumented, and impossible to change without knowing it existed.

New settings are now merged into the section they belong to, carrying the comments that explain them, and every value you had set is left exactly as it was.

Security

• Brute-force lockout moved from the account to the address. Locking the account meant anyone who knew a name could keep its owner out by failing logins on purpose, at no cost to themselves. Now the one who waits is the one guessing.
• "Remember me" is never applied to an account with 2FA. Someone who set that up has said plainly that an address is not good enough for them.
• Changing a password cancels remembered sessions. That is the whole point of changing it.
• The shared-address risk that "remember me" carries is now written next to the setting, instead of left for someone to discover.

Also in this release

• premium.uuid-type: real (default) / cracked / random, replacing a boolean. nLogin's offline is accepted as a synonym of cracked.
• Every message the plugin sends is a config key, in all 17 languages. The /rlogin help, all spawn output and every usage line were hardcoded English.
• /rlogin spawn is one layer instead of two. The moment is the spawn — no names to invent or keep in sync — plus /rlogin spawn teleport <moment> to check one is where you meant.
• The proxy config is two sections. Everything else belongs to the backends, the database included; the proxy never reads it.
• /rlogin reload closes what it replaces instead of leaking a connection pool per call, and says plainly that premium.* needs a restart.
• /rlogin changeuuid carries an account's credentials to another UUID, for when a name changes hands.
• rLogin warns when a server listed under login-servers never reports a login — that is what a missing plugin or a typo'd name looks like, and it otherwise shows up as players walking in unauthenticated.

Fixes

• register() now records the address it was called from. Without it, a cracked player carried by "remember me" was bounced once per session, forever, by the rule written to prevent exactly that.
• A verified player who dropped before joining left a flag behind for the life of the server.
• The update checker never closed its HTTP client.
• /2fa enable on an account that already had 2FA silently replaced the secret, breaking the player's authenticator with nothing on screen to explain why.

Upgrading from 1.0.0

Drop the new jar in and restart. Your config.yml gains the new settings and keeps your values. Two things move:

• premium.standalone-hybrid-mode, standalone-premium-uuid and standalone-forward-skin no longer exist. Premium verification is automatic; UUID handling is premium.uuid-type.
• On Velocity, lobby: and database: are replaced by login-servers: / after-login: / timing:. The proxy no longer uses a database at all.

Known limitations

• Metrics report nothing yet — the bStats integration stays inert until a plugin id is registered.
• The nLogin and JPremium importers are not implemented. /rlogin migrate authme works; the other two say so rather than pretending.

Requires Java 21+ and Paper/Folia 1.21+. Velocity 3.x only if you run a proxy.

rLogin 1.0.0

Premium players join without typing anything. Everyone else logs in with a password. On the same server, with no proxy required.

rLogin ships as a single jar that works on Paper, Folia and Velocity — it detects which one it's running on and enables only the relevant half. Drop it in plugins/, start the server once, and it works.

Premium auto-login without a proxy

Normally this combination needs a Velocity proxy in front, because online-mode is one server-wide switch. Turn on premium.standalone-hybrid-mode and rLogin performs Mojang's verification itself, so both work on a single online-mode: false server:

1. It holds the login and asks Mojang whether the name is a real premium account.
2. If it is, it runs the encryption handshake — the client shows its own "Encrypting…" screen and authenticates against Mojang on its own.
3. It confirms with Mojang's hasJoined that this client genuinely owns the account, not just that the username exists. Someone who only knows your name cannot fake this.
4. The player joins with their real Mojang UUID and skin, exactly as they would on any online-mode server — so permissions, economy and bans all see the same identity.

Requires the free PacketEvents plugin, which is not bundled. Without it rLogin says so in the console and stays off — no error, no crash.

premium.uuid-type

	Premium	Cracked
real (default)	real Mojang UUID	offline UUID
cracked	offline UUID	offline UUID
random	random, kept per name	random, kept per name

real is the only mode where "premium Steve" and "cracked Steve" are separate accounts. cracked (also accepted as offline) keeps an existing offline-mode world and database working untouched. random lets a player move between premium and cracked without losing their data.

Passwords never reach your logs

Minecraft servers write every command a player runs to the console and to logs/latest.log, verbatim — which for /login and /register means their password in plain text. The server does this before any plugin gets a say, so no plugin can stop it by cancelling the command.

rLogin filters it out at the logging layer instead. The command is still logged for your audit trail, with its arguments replaced:

Steve issued server command: /register hunter2 hunter2    ← never written
[rLogin] Steve ran /register ***                          ← written instead

This is not configurable, on purpose. Players reuse passwords across servers.

Everything else

• 2FA (TOTP) with any authenticator app, opt-in per player.
• Brute-force protection with escalating lockouts.
• Premium-name protection so a cracked player can't claim a premium name.
• "Remember me" sessions by IP, so a quick reconnect doesn't ask again.
• Bedrock players via Geyser/Floodgate are recognised automatically.
• Folia support from day one — regional schedulers, never the global one.
• 17 languages included: en, es, pt_BR, de, fr, ru, zh_CN, pl, it, nl, tr, uk, ja, ko, ar, vi, id. Drop in your own to add more.
• Velocity path with optional authentication-lobby routing.
• AuthMe import via /rlogin migrate authme.
• Passwords stored with bcrypt — irreversible, salted, cost-configurable.

Requirements

• Java 21+
• Paper or Folia 1.21+ for the backend
• Velocity 3.x only if you run a proxy
• PacketEvents only for standalone-hybrid-mode

Getting started

1. Put rLogin-1.0.0.jar in plugins/ and start the server once.
2. That's it for a normal setup. Everything else in plugins/rLogin/config.yml is documented inline and has a sensible default.
3. For premium auto-login on a single server: install PacketEvents and set premium.standalone-hybrid-mode: true.

Known limitations

• bStats reports nothing yet — the plugin has no bStats id registered, so the metrics integration stays inert until one is set.
• The nLogin and JPremium importers are not implemented. /rlogin migrate authme works; the other two tell you they aren't ready rather than pretending.
• /rlogin reload does not reach standalone hybrid-auth. Changing premium.* settings needs a full server restart to take effect.
• /rlogin changeuuid has not been exercised on a live server. It is covered by the code path but untested in practice.