search

lenis0012 / LoginSecurity

Lightweight and secure user authentication for Bukkit Minecraft servers
https://www.spigotmc.org/resources/loginsecurity.19362/
Apache License 2.0
104 stars 87 forks source link

Session not working after upgrading to latest version #309

Open BaxAndrei opened 1 year ago

BaxAndrei commented 1 year ago

Before upgrading, if you logged in then left and came back within 1 minute, you will be auto-logged in. Now if you leave and come back (rejoin) after even 1 second, you need to login again.

Server using BungeeCord Instance

lenis0012 commented 1 year ago

I will look into it.

lenis0012 commented 1 year ago

Please try with this build: https://ci.codemc.io/job/lenis0012/job/LoginSecurity/128/

lenis0012 commented 1 year ago

I had initially disabled the session resume logic when bungeecord is enabled. I did this a while ago in an old dev build so I don't exactly recall why but I think it may have because sometimes the player ip address is unavailable.

I ran some tests and it seems to work fine though.

BaxAndrei commented 1 year ago

Yes, it works now. The only problem is that the message that you have been authenticated automatically does not appear, otherwise everything is ok. Is there any possibility to do it in such a way that it stays connected while it is still on the bungeecord? If he changes the server but returns to the lobby, will he still be connected?

lenis0012 commented 1 year ago

Not really unfortunately. There is no way to detect whether a player has since rejoined the proxy.

I have been thinking about some ways to make bungeecord support better and more seamless but I haven't come to solution yet that works for all use-cases.

I probably will come up with some solution in LoginSecurity 4.0 though.

BaxAndrei commented 1 year ago

I made a work around to support bungeecord and every time a player changes the status of the AuthModeChangedEvent event I send to bungeecord via pluginmessage channel that he has been authenticated/deauthenticated to prevent unauthenticated players from using bungeecord commands. It can be done in the same way in this case (I think), and send the session to a separate plugin for proxy, and in case it re-enters the lobby server, loginsecurity first requests data from the plugin on the proxy to know if the player has been connected to the network all this time.

lenis0012 commented 1 year ago

@BaxAndrei That is pretty clever but isn't it true that you can only send bungee plugin messages 1 tick after the player joined? And it can take a little bit of time until you get a reply.

That means that features like the location hiding can't really be used because you don't know in advance if the player is logged in or not. Same for blindness. You don't want to give the player blindness only to take it away again a split second later when it turns out they were logged in after all.

I think the only feasible way to do this is to forcibly send unauthorized players to the hub. and then send them back to the original server upon successful login. Preferably the plugin would not be installed on the other servers at all. But that would require all of the commands of LoginSecurity to be supported on BungeeCord as well. Which would require a pretty significant rewrite of the current code.

BaxAndrei commented 1 year ago

isn't it true that you can only send bungee plugin messages 1 tick after the player joined - Yeah, this is true. By default I assume that player is logged out until receive plugin message with login status.

d4rkmidian commented 7 months ago

I'm a server owner and tried the dev build 3.3.1 and still after a while session is not saved and asks for login. My server is Paper 1.20.1.