¡Players can't join!

[brondonychocmans]

Hi!! im having a huge problem...
Tons of players are getting kikked out from my server due to the pluggin not recongnsing their ip it seems?

[16:54:13 INFO]: /179.6.28.248:48966 lost connection: Disconnected
[16:54:19 INFO]: [FastLogin] New packet START[class=PacketLoginInStart, id=0] from com.comphenix.protocol.injector.temporary.TemporaryPlayerInvocationHandler@5183f5b2
[16:54:19 INFO]: [FastLogin] Handling player Jin
[16:54:19 INFO]: [FastLogin] GameProfile Jin uses a premium username
[16:54:20 INFO]: [FastLogin] New packet ENCRYPTION_BEGIN[class=PacketLoginInEncryptionBegin, id=1] from com.comphenix.protocol.injector.temporary.TemporaryPlayerInvocationHandler@5183f5b2
[16:54:20 INFO]: [FastLogin] Enabling onlinemode encryption for /179.6.28.248:49269
[16:54:20 ERROR]: [FastLogin] Session server rejected incoming connection for GameProfile Jin (/179.6.28.248). Possible reasons are1) Client IP address contacting Mojang and server during server join were different (Do you use a reverse proxy? -> Enable IP forwarding, or disable the feature in the config). 2) Player is offline, but tried to bypass the authentication3) Client uses an outdated username for connecting (Fix: Restart client)
[16:54:20 WARN]: [FastLogin] If you think this is an error, please verify that the incoming IP address /179.6.28.248 is not associated with a server hosting company.
[16:54:20 WARN]: [FastLogin] This indicates the use of reverse-proxy like HAProxy, TCPShield, BungeeCord, Velocity, etc. By default (configurable in the config) this plugin requests Mojang to verify the connecting IP to this server with the one used to log into Minecraft to prevent MITM attacks. In order to work this security feature, the actual client IP needs to be forwarding (keyword IP forwarding). This process will also be useful for other server features like IP banning, so that it doesn't ban the proxy IP.

I tried telling them to change their names... But then they just got disconected without errors or warnings...

For 3 different players the error was Ìnternal Exception: io.netty.handlet.codec.DecoderExeption: java.lang.IndexOutOfBoundsExeption: Index 68 out of bounds for lenght 10

Im really really sorry im not an expert in ips and databases, so plsss i'll be incredibly gratefull if some one could help me...

Here is my config:

# FastLogin config
# Project site: https://www.spigotmc.org/resources/fastlogin.14153
# Source code: https://github.com/games647/FastLogin
#
# You can access the newest config here:
# https://github.com/games647/FastLogin/blob/main/core/src/main/resources/config.yml

# This a **very** simple anti bot protection. Recommendation is to use a dedicated program to approach this
# problem. Low level firewalls like uwf (or iptables direct) are more efficient than a Minecraft plugin. TCP reverse
# proxies could also be used and offload some work even to different host.
#
# The settings wil limit how many connections this plugin will handle. After hitting this limit. FastLogin will
# completely ignore incoming connections. Effectively there will be no database requests and network requests.
# Therefore, auto logins won't be possible.
anti-bot:
  enabled: true
  # Image the following like bucket. The following is total amount that is allowed in this bucket, while expire
  # means how long it takes for every entry to expire.
  # Total number of connections
  connections: 600
  # Amount of minutes after the first connection got inserted will expire and made available
  expire: 10
  # Action - Which action should be performed when the bucket is full (too many connections)
  # Allowed values are: 'ignore' (FastLogin drops handling the player) or 'block' (block this incoming connection)
  action: 'ignore'

# Request a premium login without forcing the player to type a command
#
# If you activate autoRegister, this plugin will check/do these points on login:
# 1. An existing cracked account shouldn't exist
# -> paid accounts cannot steal the existing account of cracked players
# - (Already registered players could still use the /premium command to activate premium checks)
# 2. Automatically registers an account with a strong random generated password
# -> cracked player cannot register an account for the premium player and so cannot the steal the account
#
# Furthermore the premium player check have to be made based on the player name
# This means if a cracked player connects to the server, we request a paid account login from this player
# the player just disconnect and sees the message: 'bad login' or 'invalid session'
# There is no way to change this message
# For more information: https://github.com/games647/FastLogin#why-do-players-have-to-invoke-a-command
autoRegister: true

# Should FastLogin respect per IP limit of registrations (e.g. in AuthMe)
# Because most auth plugins do their stuff async - FastLogin will still think the player was registered
# To work best - you also need to enable auto-register-unknown
#
# If set to true - FastLogin will always attempt to register the player, even if the limit is exceeded
# It is up to the auth plugin to handle the excessive registration
# https://github.com/games647/FastLogin/issues/458
respectIpLimit: false

# This is extra configuration option to the feature above. If we request a premium authentication from a player who
# isn't actual premium but used a premium username, the player will disconnect with the reason "invalid session" or
# "bad login".
#
# If you activate this, we are remembering this player and do not force another premium authentication if the player
# tries to join again, so the player could join as cracked player.
secondAttemptCracked: true

# New cracked players will be kicked from server. Good if you want switch from offline-mode to online-mode without
# losing players!
#
# Existing cracked and premium players could still join your server. Moreover, you could add player names to an
# allow-list.
# So that these cracked players could join too, although they are new players.
#ONLINE MODEEE!!!!!! ATENTO ACÁ BRONDONYYYYYY
#ONLINE MODEEE!!!!!! ATENTO ACÁ BRONDONYYYYYY
#ONLINE MODEEE!!!!!! ATENTO ACÁ BRONDONYYYYYY
#ONLINE MODEEE!!!!!! ATENTO ACÁ BRONDONYYYYYY
#ONLINE MODEEE!!!!!! ATENTO ACÁ BRONDONYYYYYY
#ONLINE MODEEE!!!!!! ATENTO ACÁ BRONDONYYYYYY
switchMode: false

# If this plugin detected that a player has a premium, it can also set the associated
# uuid from that account. So if the player changes the username, they will still have
# the same player data (inventory, permissions, ...)
#
# Warning: This also means that the UUID will be different if the player is connecting
# through an offline mode connection. This **could** cause plugin compatibility issues.
#
# This is an example and doesn't apply for every plugin.
# Example: If you want to ban players who aren't online at the moment, the ban plugin will look
# after an offline uuid associated to the player, because the server is in offline mode. Then the premium
# players could still join the server, because they have different UUID.
#
# Moreover, you may want to convert the offline UUID to a premium UUID. This will ensure that the player
# will have the same inventory, permissions, ... if they switched to premium authentication from offline/cracked
# authentication.
#
# This feature requires Cauldron, Spigot or a fork of Spigot (Paper)
premiumUuid: true

# This will make an additional check (only for player names which are not in the database) against the mojang servers
# in order to get the premium UUID. If that premium UUID is in the database, we can assume on successful login that the
# player changed its username and then update the name in the database.
# Examples:
# #### Case 1
# autoRegister = false
# nameChangeCheck = false
#
# GameProfile logins as cracked until the player invoked the command /premium. Then we could override the existing
# database record.
#
# #### Case 2
# autoRegister = false
# nameChangeCheck = true
#
# Connect the Mojang API and check what UUID the player has (UUID exists => Paid Minecraft account). If that UUID is in
# the database it's an **existing player** and FastLogin can **assume** the player is premium and changed the username.
# If it's not in the database, it's a new player and **could be a cracked player**. So we just use an offline mode
# authentication for this player.
#
# **Limitation**: Cracked players who use the new username of a paid account cannot join the server if the database
# contains the old name. (Example: The owner of the paid account no longer plays on the server, but changed the username
# in the meanwhile).
#
# #### Case 3
# autoRegister = true
# nameChangeCheck = false
#
# We will always request a premium authentication if the username is unknown to us, but is in use by a paid Minecraft
# account. This means it's kind of a more aggressive check like nameChangeCheck = true and autoRegister = false, because
# it requests a premium authentication which are completely new to us, that even the premium UUID is not in our database.
#
# **Limitation**: see below
#
# #### Case 4
# autoRegister = true
# nameChangeCheck = true
#
# Based on autoRegister it checks if the player name is premium and login using a premium authentication. After that
# fastlogin receives the premium UUID and can update the database record.
#
# **Limitation from autoRegister**: New offline players who use the username of an existing Minecraft cannot join the
# server.
nameChangeCheck: false

# If your players have a premium account and a skin associated to their account, this plugin
# can download the data and set it to the online player.
#
# Keep in mind that this will only work if the player:
# * is the owner of the premium account
# * the server connection is established through a premium connection (paid account authentication)
# * has a skin
#
# This means this plugin doesn't need to create a new connection to the Mojang servers, because
# the skin data is included in the Auth-Verification-Response sent by Mojang. If you want to use for other
# players like cracked player, you have to use other plugins.
#
# If you use PaperSpigot - FastLogin will always try to set the skin, even if forwardSkin is set to false
# It is needed to allow premium name change to work correctly
# https://github.com/games647/FastLogin/issues/457
#
# If you want to use skins for your cracked player, you need an additional plugin like
# ChangeSkin, SkinRestorer, ...
forwardSkin: true

# Displays a warning message that this message SHOULD only be invoked by
# users who actually are the owner of this account. So not by cracked players
#
# If they still want to invoke the command, they have to invoke /premium again
premium-warning: true

# ======[[ Spigot+ProtocolLib users only ]]======
# When set to true, enables the use of alternative session resolver which does not send the server IP
# to mojang session servers. This setting might be useful when you are trying to run the server via a
# transparent reverse proxy or some other form of DNAT. As far as security goes, this setting has
# negligible to no security impact.
#
# This setting works on a similar principle as 'prevent-proxy' setting in server.properties.
# When set to false, the server behaves like prevent-proxy was set to true and vice-versa.
# Normally, when you use the prevent-proxy=true, you would want this disabled.
#
# Please note that this setting has no effect when used outside of Spigot+ProtocolLib context.
#
# !!! [WARNING] !!!
# This option is considered highly experimental. While it is highly unlikely this will break your server,
# more tests need to be conducted in order to verify its effectiveness. Brief tests seemed promising, but
# every environment is different, and so it might not work for you as it did for me.
useProxyAgnosticResolver: true

# If you have autoRegister or nameChangeCheck enabled, you could be rate-limited by Mojang.
# The requests of the both options will be only made by FastLogin if the username is unknown to the server
# You are allowed to make 600 requests per 10-minutes (60 per minute)
# If you own a big server this value could be too low
# Once the limit is reached, new players are always logged in as cracked until the rate-limit is expired.
# (to the next ten minutes)
#
# The limit is IP-wide. If you have multiple IPv4-addresses you specify them here. FastLogin will then use it in
# rotating order --> 5 different IP-addresses 5 * 600 per 10 minutes
# If this list is empty only the default one will be used
#
# Lists are created like this:
ip-addresses:
    - 192.168.1.20

# How many requests should be established to the Mojang API for Name -> UUID requests. Some other plugins as well
# as the head Minecraft block make such requests as well. Using this option you can limit the amount requests this
# plugin should make.
#
# If you lower this value, other plugins could still make requests while FastLogin cannot.
# Mojang limits the amount of request to 600 per 10 minutes per IPv4-address.
mojang-request-limit: 600

# This option automatically registers players which are in the FastLogin database, but not in the auth plugin database.
# This can happen if you switch your auth plugin or cleared the database of the auth plugin.
# https://github.com/games647/FastLogin/issues/85
auto-register-unknown: true

# By setting this option to false, you can disable the auto login from fastlogin. So a premium (like a paid account)
# authentication is requested, but the player won't be auto logged into the account from the auth plugin.
#
# This can be used as 2Factor authentication for better security of your accounts. A hacker then needs both passwords.
# The password of your Minecraft and the password to login in with your auth plugin
autoLogin: true

# Floodgate configuration
# Connecting through Floodgate requires player's to sign in via their Xbox Live account
# !!!!!!!! WARNING: FLOODGATE SUPPORT IS AN EXPERIMENTAL FEATURE !!!!!!!!
# Enabling any of these settings might lead to people gaining unauthorized access to other's accounts!

# Automatically log in players connecting through Floodgate.
# Possible values:
#   false: Disables auto login for every player connecting through Floodgate
#   true: Enables auto login for every player connecting through Floodgate
#   linked: Only Bedrock accounts that are linked to a Java account will be logged in automatically
#   no-conflict: Bedrock players will only be automatically logged in if the Mojang API reports
#     that there is no existing Premium Java MC account with their name.
#     This option can be useful if you are not using 'username-prefix' in floodgate/config.yml
# Requires 'autoLogin' to be 'true'
# !!!!!!!! WARNING: FLOODGATE SUPPORT IS AN EXPERIMENTAL FEATURE !!!!!!!!
# Enabling this might lead to people gaining unauthorized access to other's accounts!
autoLoginFloodgate: false

# This enables Floodgate or Offline Geyser players to join the server, even if they are using the name of an
# existing Java **PREMIUM** account (so someone has bought Minecraft with that username)
#
# Java and Bedrock players will get different UUIDs, so their inventories, location, etc. will be different.
# However, some plugins (such as AuthMe) rely on names instead of UUIDs to identify a player which might cause issues.
# In the case of AuthMe (and other auth plugins), both the Java and the Bedrock player will have the same password.
#
# To prevent conflicts from two different players having the same name, it is highly recommended using a
#    'username-prefix' in floodgate/config.yml
#
# Possible values:
#   false: Kick Bedrock players, if they are using an existing Premium Java account's name
#     Note: Linked Floodgate players have the same name as their Java profile, so the Bedrock player will always conflict
#     their own Java account's name. Therefore, setting this to false will prevent any linked player from joining.
#   true: Bypass name conflict checking.
#   linked: Floodgate accounts linked to a Java account will be allowed to join with conflicting names
#     For Offline Geyser players, 'linked' works as 'false'
# !!!!!!!! WARNING: FLOODGATE/GEYSER SUPPORT IS AN EXPERIMENTAL FEATURE !!!!!!!!
# Enabling this might lead to people gaining unauthorized access to other's accounts!
allowFloodgateNameConflict: false

# Automatically register players connecting through Floodgate.
# autoLoginFloodgate must be available for the player to use this
# Possible values:
#   false: Disables auto registering for every player connecting through Floodgate
#   true: Enables auto registering for every player connecting through Floodgate
#   linked: Only Bedrock accounts that are linked to a Java account will be registered automatically
#   no-conflict: Bedrock players will only be automatically registered if the Mojang API reports
#     that there is no existing Premium Java MC account with their name.
#     This option can be useful if you are not using 'username-prefix' in floodgate/config.yml
# Requires 'autoRegister' to be 'true'
# !!!!!!!! WARNING: FLOODGATE SUPPORT IS AN EXPERIMENTAL FEATURE !!!!!!!!
# Enabling this might lead to people gaining unauthorized access to other's accounts!
autoRegisterFloodgate: false

# This option resembles the vanilla configuration option 'enforce-secure-profile' in the 'server.properties' file.
# It verifies if the incoming cryptographic key in the login request from the player is signed by Mojang. This key
# is necessary for servers where you or other in-game players want to verify that a chat message sent and signed by
# this player is not modified by any third-party. Modifications by your server would also invalidate the message.
#
# This feature is only relevant if you use the plugin in ProtocolLib mode and use 1.19+.
# This also the case if you don't have any proxies in use.
verifyClientKeys: false

# Database configuration
# Recommended is the use of MariaDB (a better version of MySQL)

# Single file SQLite database
driver: 'sqlite'
# File location
database: '{pluginDir}/FastLogin.db'

# MySQL/MariaDB
# If you want to enable it, uncomment only the lines below; this not this line.
# If on velocity use 'mariadb' as the driver
#driver: 'mysql'
#host: '127.0.0.1'
#port: 3306
#database: 'fastlogin'
#username: 'myUser'
#password: 'myPassword'

# Advanced Connection Pool settings in seconds
#timeout: 30
#lifetime: 30

## It's recommended to enable SSL if the MySQL server isn't running on the same host
## This will encrypt the connection for secure transportation of the sql server password
#useSSL: false
## Verification requirements for the server cert,
## Values: Required (unchecked SSL connection), VerifyCA (verify CA), VerifyFull (verify CA and matching hostname)
#sslMode=Required
## TLS is preferred for this technique, then your host stored certificate store will be used to verify the server cert
## Similar to HTTPS. If that's not possible RSA can be used with the following options.
## This allows to request the public RSA key from the server to encrypt the data to it. True would allow machine-in-the-
## middle attacks.
#allowPublicKeyRetrieval=false
## Path to the RSA public key if key retrieval is forbidden
#ServerRSAPublicKeyFile=

# HTTP proxies for connecting to the Mojang servers in order to check if the username of a player is premium.
# This is a workaround to prevent rate-limiting by Mojang. These proxies will only be used once your server hit
# the rate-limit or the custom value above.
# Please make sure you use reliable proxies.
proxies:
  # 'IP:Port' or 'Domain:Port'
  # - 'xyz.com:1337'
  # - 'test.com:5131'

PD: Sorry for my broken english, is not my native lenguaje, another reason for me to be incredibly confused with some tecnic stuff...

[games647]

The error is about that Mojang thinks some proxy is between the player and your server. You can configure this check in the configuration with: useProxyAgnosticResolver: false.

In other words in the current situation Mojang rejects the connection, because it looks like this:

Currently: Player -> Proxy -> Minecraft server

However it should be a direct connection like:

Expected: Player -> Minecraft server

This error can also happen if you use reverse proxies like Cloudflare, TCPShield, etc. So you have something like:

Player -> TCPShield/Cloudflare/... -> Minecraft server

[brondonychocmans]

Hii!!! i already tried changing useProxyAgnosticResolver: false and useProxyAgnosticResolver: true and in both cases my new players get kicked out with the same error...

And for the reverse proxy, i have no idea what that is... So i imagine i don't have one? My server is self hosted (hosted in a pc), therefore there is no extra steps or seccond parties envolved in my player's conection.

So... Im still in the same place as before... :(

[games647]

I tried telling them to change their names... But then they just got disconected without errors or warnings...

What a second? You have autoRegister enabled. This means that if the player uses a premium username, they are assumed to actually own a Mojang account. This plugin cannot change this disconnect message, because the client disconnects on its own if we are requesting a premium connection. The consequence is that offline players disconnect if they choose a premium username. You can manually allow individual players with /cracked <player>. However, this is a manual process.we

The alternative is to disable autoRegister and allow players to opt-in. This means that player activate the premium login on their own using /premium.

The background for this behavior is that the decision for whether activating premium have to be based solely on the following details:

• Connection details like IP address
• Minecraft username

That is not much.

[brondonychocmans]

I see... Will they get back their inventories?
Yesterday i had to dissable the pluggin (bc of the problem described in the main page), and that produced all my players to loose their inventories...

With this solution they should get back their stuff right?

Is a little weird that this pluggin affects inventories... But well... It is what it is

[games647]

Inventories and many other things are tied to their UUID (a unique identifier). In offline mode it is the username and in online mode it's associated to the Mojang account in order to allow name changes. This change was done by Mojang themselves. However, you can force Fast login to always enforce the offline variant in the configuration.