# SecureRedirect Setup Guide<\/p>\n
This guide explains how to install and configure the **SecureRedirect** Paper plugin so players can be securely redirected from one server (“main”) to another (“dest”) using transfer packets and cookies.<\/p>\n
> Recommended Paper version: **1.21.11** (or later with `Player#transfer` support)<\/p>\n
> **DISCLAIMER!!! YOU MUST JOIN THE SERVER WITH A PORT!!!** ### 1.1. Build or download the JAR<\/p>\n If you are using this repo directly:<\/p>\n 1. Run: Copy that JAR to each Paper server that should participate in redirects.<\/p>\n ### 1.2. Drop the plugin into each server<\/p>\n For **each** Paper server (main and dest):<\/p>\n 1. Stop the server if it is running. —<\/p>\n This is the server where players join normally and run `\/redirect`.<\/p>\n Edit `plugins\/SecureRedirect\/config.yml` on the **main** server.<\/p>\n ### 2.1. Basic redirect target<\/p>\n “`yaml # Will be filled by \/redirect gen-hash # Not required on MAIN, can be left empty # Players can join MAIN directly Notes: ### 2.2. Origin ID (optional)<\/p>\n “`yaml # On MAIN you typically allow redirects from anywhere, so this list can stay empty You only need to care about `origin-id` and `allowed-origins` if you want to restrict which servers are allowed to redirect **into** another server (see the dest config section).<\/p>\n ### 2.3. Generate the send-hash<\/p>\n On the **main** server, in-game as an OP or from the console:<\/p>\n “`text This will: Copy this value; you will paste it into the **dest** server `receive-hash`.<\/p>\n<\/details>\n —<\/p>\n This is the server that players are redirected TO.<\/p>\n ### 3.1. Enable transfers in server.properties<\/p>\n Edit `server.properties` on the **dest** server:<\/p>\n “`properties Then **fully restart** the dest server.<\/p>\n ### 3.2. Basic config.yml<\/p>\n Edit `plugins\/SecureRedirect\/config.yml` on the **dest** server:<\/p>\n “`yaml # Optional on DEST unless you want it to send players further. # IMPORTANT: must match MAIN’s send-hash # Identifier this server uses when redirecting players # Which origin servers are allowed to redirect into DEST. # Block direct joins; only transfers are allowed kick-no-transfer-message: “You must join this server via secure redirect.”<\/p>\n kick-bad-hash-message: “Invalid or missing redirect token.” ### 3.3. Restart after editing<\/p>\n After changing `config.yml` on DEST, **restart the server** (or at least reload the plugin) so the new values are applied.<\/p>\n<\/details>\n —<\/p>\n ### 4.1. Redirect yourself<\/p>\n On the **main** server, as a player with permission:<\/p>\n “`text This will: ### 4.2. Redirect another player<\/p>\n “`text Permissions: ### 4.3. Rotating the token<\/p>\n Any time you want to change the secret token:<\/p>\n 1. On MAIN, run: —<\/p>\n The plugin encodes the redirect token as:<\/p>\n “`text On DEST, when a player joins via transfer, the plugin:<\/p>\n 1. Verifies `player.isTransferred()`. This lets you restrict which servers are allowed to redirect into DEST.<\/p>\n **Example multi-origin setup:**<\/p>\n – MAIN server: – LOBBY server: – DEST server: Now only `main` and `lobby` can send players into `dest` (provided their hashes also match `receive-hash`).<\/p>\n<\/details>\n —<\/p>\n ### 6.1. Stuck on “Transferring to a new server…”<\/p>\n If the client never finishes transferring and no errors appear in the console:<\/p>\n – Check on the **DEST** server: ### 6.2. Direct join still works on DEST<\/p>\n – Ensure on DEST `config.yml`: ### 6.3. “Invalid or missing redirect token”<\/p>\n – Confirm that on DEST: Hashed server redirect service.<\/p>\n","protected":false},"featured_media":136871,"template":"","meta":{"_minecraft_slug":"secureredirect","_minecraft_project_id":"Lgh8pQkA","_minecraft_author":"codingsushi","_minecraft_license":"Apache-2.0","_minecraft_downloads":47,"_minecraft_follows":0,"_minecraft_client_side":"unsupported","_minecraft_server_side":"required","_minecraft_storage_type":"zip","_minecraft_archive_name":"secureredirect.zip","_minecraft_size_bytes":20741,"_minecraft_version_count":3,"_minecraft_updated_at":"2026-05-15T21:25:08.129199Z","_minecraft_date_created":"2026-01-24T19:07:50.507466Z","_minecraft_date_modified":"2026-01-27T15:06:06.147357Z","_minecraft_project_url":"https:\/\/modrinth.com\/mod\/secureredirect","_minecraft_icon_attachment_id":136871,"_minecraft_imported_at":"2026-06-08T02:05:35+00:00","_minecraft_import_hash":"241ebe87e10b49a9d4c637deec016e4d","_minecraft_versions":"","_minecraft_links":"","_minecraft_gallery":"","_minecraft_api_metadata":""},"mod_category":[124,127],"mod_loader":[130,132],"minecraft_version":[62,37,40,41,73,74,38,78,79,80,81,82],"class_list":["post-136870","mod","type-mod","status-publish","has-post-thumbnail","hentry","mod_category-bukkit","mod_category-paper","mod_loader-bukkit","mod_loader-paper","minecraft_version-1-21","minecraft_version-1-21-1","minecraft_version-1-21-10","minecraft_version-1-21-11","minecraft_version-1-21-2","minecraft_version-1-21-3","minecraft_version-1-21-4","minecraft_version-1-21-5","minecraft_version-1-21-6","minecraft_version-1-21-7","minecraft_version-1-21-8","minecraft_version-1-21-9"],"yoast_head":"\n
\n—<\/p>\n1. Install the plugin<\/strong><\/summary>\n
\n “`bash
\n gradle build
\n “`
\n2. The plugin JAR will be at:
\n – `build\/libs\/SecureRedirect-1.0.2.jar`<\/p>\n
\n2. Place `SecureRedirect-1.0.2.jar` into the `plugins\/` folder.
\n3. Start the server once so it generates `plugins\/SecureRedirect\/config.yml`.<\/p>\n<\/details>\n2. Configure the main (source) server<\/strong><\/summary>\n
\n# Where to send players when using \/redirect on MAIN
\ntarget-host: “your-dest-host” # e.g. “hello.exaroton.me”
\n# Optional. If omitted or invalid, defaults to 25565.
\n# target-port: 25565<\/p>\n
\nsend-hash: “”<\/p>\n
\nreceive-hash: “”<\/p>\n
\nrequire-transfer: false
\n“`<\/p>\n
\n– If your destination uses the **default port 25565**, you can omit `target-port` entirely.
\n– If your destination uses a custom port (e.g. `25566`), set it explicitly:
\n “`yaml
\n target-port: 25566
\n “`<\/p>\n
\n# Identifier this server uses when redirecting players
\norigin-id: “main”<\/p>\n
\nallowed-origins: []
\n“`<\/p>\n
\n\/redirect gen-hash
\n“`<\/p>\n
\n– Generate a random hex hash.
\n– Save it into `send-hash` in `config.yml`.
\n– Print the value in chat \/ console.<\/p>\n3. Configure the destination server<\/strong><\/summary>\n
\naccepts-transfers=true
\n“`<\/p>\n
\n# target-host\/target-port are only needed if DEST will redirect players onward.
\n# For a simple two-server setup you can leave them as defaults.
\ntarget-host: “127.0.0.1”
\n# Optional. If omitted or invalid, defaults to 25565.
\n# target-port: 25565<\/p>\n
\nsend-hash: “”<\/p>\n
\nreceive-hash: “
\norigin-id: “dest”<\/p>\n
\n# Make sure this list contains MAIN’s origin-id.
\nallowed-origins:
\n – “main”<\/p>\n
\nrequire-transfer: true<\/p>\n
\n“`<\/p>\n4. Using the plugin<\/strong><\/summary>\n
\n\/redirect
\n“`<\/p>\n
\n– Attach a cookie to you containing `
\n– Use Mojang’s transfer packet to move you to `target-host:target-port`.<\/p>\n
\n\/redirect
\n– `secureredirect.redirect` \u2013 use `\/redirect` on yourself.
\n– `secureredirect.redirect.others` \u2013 use `\/redirect
\n– `secureredirect.genhash` \u2013 use `\/redirect gen-hash`.<\/p>\n
\n “`text
\n \/redirect gen-hash
\n “`
\n2. Copy the new `send-hash` value.
\n3. On DEST, update `receive-hash` in `config.yml` to this new value.
\n4. Restart DEST so it reads the new config.<\/p>\n<\/details>\n5. Advanced: origin-id and allowed-origins<\/strong><\/summary>\n
\n
\n“`<\/p>\n
\n2. Reads and parses the cookie into `origin-id` and `hash`.
\n3. Checks that `hash` matches `receive-hash`.
\n4. If `allowed-origins` is **non-empty**, checks that `origin-id` is listed there.<\/p>\n
\n “`yaml
\n origin-id: “main”
\n allowed-origins: []
\n “`<\/p>\n
\n “`yaml
\n origin-id: “lobby”
\n allowed-origins: []
\n “`<\/p>\n
\n “`yaml
\n origin-id: “dest”
\n allowed-origins:
\n – “main”
\n – “lobby”
\n “`<\/p>\n6. Troubleshooting<\/strong><\/summary>\n
\n – `accepts-transfers=true` is set in `server.properties`.
\n – The server is actually Paper 1.21.x (not Spigot or a proxy binary).
\n– Check on the **MAIN** server:
\n – `target-host` and `target-port` point to the correct DEST address.
\n– Watch the DEST console while running `\/redirect`:
\n – If no login\/join messages appear, the client is not reaching that server (host\/port\/host limitations).<\/p>\n
\n “`yaml
\n require-transfer: true
\n “`
\n– Restart DEST after changing the config.
\n– Make sure `SecureRedirect` is listed as enabled in `\/plugins`.<\/p>\n
\n – `receive-hash` exactly matches MAIN’s `send-hash`.
\n– Confirm that on DEST:
\n – `allowed-origins` contains MAIN’s `origin-id` (or is empty to allow any).<\/p>\n<\/details>\n","protected":false},"excerpt":{"rendered":"