search

kyngs / LibreLogin

Open-source, multiplatform, and highly customizable authentication plugin with outstanding features and API.
Mozilla Public License 2.0
171 stars 56 forks source link

Recording in the database who did not register #161

Closed DxrkCat closed 11 months ago

DxrkCat commented 11 months ago

We were testing a bot attack and the database wrote them in, they have the hash field empty. Velocity build 290 librelogin 0.18.0

kyngs commented 11 months ago

That's the intended behavior, LibreLogin records all players that join. If you want to mitigate this, install an antibot plugin. Librelogin is not an antibot solution.

DxrkCat commented 11 months ago

That's the intended behavior, LibreLogin records all players that join. If you want to mitigate this, install an antibot plugin. Librelogin is not an antibot solution.

Why store users without passwords, they can be cleaned up over time or not stored at all. No ideal anti-bot will be bypassed sooner or later and do you think if I am connected to MySQL it will hold so many records? I believe that you need to clean or not write to the database.

kyngs commented 11 months ago

That's the intended behavior, LibreLogin records all players that join. If you want to mitigate this, install an antibot plugin. Librelogin is not an antibot solution.

Why store users without passwords, they can be cleaned up over time or not stored at all. No ideal anti-bot will be bypassed sooner or later and do you think if I am connected to MySQL it will hold so many records? I believe that you need to clean or not write to the database.

I remember the original reason was to do some level of caching. MySQL can easily hold millions of records. If you do not like this feature, you're more than free to modify LibreLogin and remove it.