ClassiCube / MCGalaxy

A Minecraft Classic / ClassiCube server software
GNU General Public License v3.0
168 stars 79 forks source link

Microsoft Authentication Proof Of Concept #668

Closed craftycodie closed 2 years ago

craftycodie commented 2 years ago

To my knowledge, Classic does not have mppass until 0.0.17a. This means 0.0.15a and 0.0.16a clients cannot authenticate with servers which have verify-names enabled. This is mainly an issue for 0.0.16a as 0.0.15a is not supported yet.

A fix for this is to essentially implement Minecraft's modern day authentication as a fallback. Third party launchers can implement the client-side portion of this, and it is good practice for secure classic auth to do this already, MineOnline already does and Betacraft supports it to a degree.

The system is quite simple, upon joining we send a request to Mojang's session server API with the server's ID and the user's username, and it will return a response confirming that they are who they claim to be.

Please note, I've not worked with this project much before and I've not even got my IDE properly setup right now so I've opened this as a draft as it is completely untested. That said, I've implemented this solution before in other projects so it should work, you might need to fix some imports is all :p

craftycodie commented 2 years ago

Moved to a plugin https://github.com/craftycodie/MCGalaxy-MicrosoftAuthenticatorPlugin