rLogin 1.1.0

Premium auto-login now turns itself on wherever it is needed. There is no setting to find, and no setting to forget.

The change that matters

1.0.0 shipped standalone premium auto-login off by default, behind premium.standalone-hybrid-mode. On a real public server nobody found it: premium players were asked for a password and the feature looked broken. A setting whose only correct value is "whatever matches your setup" is not a setting.

It is gone. rLogin reads online-mode, paper-global.yml and spigot.yml, works out whether anything else verifies your players, and verifies them itself exactly when nothing does.

Where it verifies, PacketEvents is required. A standalone server without it now refuses every connection, with a banner in the console and an explanation on the player's disconnect screen. That is deliberate: switching the plugin off instead would leave an offline-mode server with no authentication at all, where anyone could join under any name, including yours. Refusing is the safe failure.

PacketEvents stays a separate download because it is GPL-3.0 and rLogin is MIT — bundling it would relicense this plugin.

Your config survives upgrades

Until now the file was only written when missing, so a server that already had one never saw a new setting. It worked on the default: invisible, undocumented, and impossible to change without knowing it existed.

New settings are now merged into the section they belong to, carrying the comments that explain them, and every value you had set is left exactly as it was.

Security

• Brute-force lockout moved from the account to the address. Locking the account meant anyone who knew a name could keep its owner out by failing logins on purpose, at no cost to themselves. Now the one who waits is the one guessing.
• "Remember me" is never applied to an account with 2FA. Someone who set that up has said plainly that an address is not good enough for them.
• Changing a password cancels remembered sessions. That is the whole point of changing it.
• The shared-address risk that "remember me" carries is now written next to the setting, instead of left for someone to discover.

Also in this release

• premium.uuid-type: real (default) / cracked / random, replacing a boolean. nLogin's offline is accepted as a synonym of cracked.
• Every message the plugin sends is a config key, in all 17 languages. The /rlogin help, all spawn output and every usage line were hardcoded English.
• /rlogin spawn is one layer instead of two. The moment is the spawn — no names to invent or keep in sync — plus /rlogin spawn teleport <moment> to check one is where you meant.
• The proxy config is two sections. Everything else belongs to the backends, the database included; the proxy never reads it.
• /rlogin reload closes what it replaces instead of leaking a connection pool per call, and says plainly that premium.* needs a restart.
• /rlogin changeuuid carries an account's credentials to another UUID, for when a name changes hands.
• rLogin warns when a server listed under login-servers never reports a login — that is what a missing plugin or a typo'd name looks like, and it otherwise shows up as players walking in unauthenticated.

Fixes

• register() now records the address it was called from. Without it, a cracked player carried by "remember me" was bounced once per session, forever, by the rule written to prevent exactly that.
• A verified player who dropped before joining left a flag behind for the life of the server.
• The update checker never closed its HTTP client.
• /2fa enable on an account that already had 2FA silently replaced the secret, breaking the player's authenticator with nothing on screen to explain why.

Upgrading from 1.0.0

Drop the new jar in and restart. Your config.yml gains the new settings and keeps your values. Two things move:

• premium.standalone-hybrid-mode, standalone-premium-uuid and standalone-forward-skin no longer exist. Premium verification is automatic; UUID handling is premium.uuid-type.
• On Velocity, lobby: and database: are replaced by login-servers: / after-login: / timing:. The proxy no longer uses a database at all.

Known limitations

• Metrics report nothing yet — the bStats integration stays inert until a plugin id is registered.
• The nLogin and JPremium importers are not implemented. /rlogin migrate authme works; the other two say so rather than pretending.

Requires Java 21+ and Paper/Folia 1.21+. Velocity 3.x only if you run a proxy.