# LoginX \u2014 Player Authentication & Session Protection<\/p>\n
**LoginX** is a secure, modern authentication plugin for Minecraft servers that require players to register and log in. It protects accounts with encrypted passwords, persistent sessions, client fingerprinting, and a two-phase Mojang premium verification system \u2014 all built with async database operations for minimal server impact.<\/p>\n
—<\/p>\n
## Why LoginX?<\/p>\n
LoginX was designed with a clean, layered architecture separating auth, session, security, and premium logic. It goes beyond basic login\/register by actively protecting against account takeovers, alt account flooding, brute-force attacks, and replay attacks \u2014 out of the box, with zero extra setup.<\/p>\n
—<\/p>\n
## Core Features<\/p>\n
### \ud83d\udd11 Authentication
\n– Password hashing with **Argon2** or **bcrypt** (configurable in `config.yml`)
\n– Configurable **minimum password length**
\n– **Login timeout** \u2014 players who don’t authenticate within N seconds are kicked
\n– `\/changepass` command for players to update their own password securely<\/p>\n
### \ud83d\udd50 Session Management
\n– **Persistent sessions** \u2014 authenticated players are remembered across reconnects
\n– **Rolling sessions** \u2014 activity extends the session timer automatically
\n– Sessions are **invalidated on IP change** to prevent session hijacking
\n– Sessions are **invalidated on fingerprint change** for extra protection
\n– Automatic **session cleanup task** runs in the background to purge expired sessions<\/p>\n
### \ud83d\udd90 Client Fingerprinting
\n– Tracks each player’s **client brand** and **protocol version** on join
\n– Detects when a player’s fingerprint changes and can block or flag it
\n– Configurable **max fingerprint changes per 7 days** to limit suspicious behaviour
\n– Stricter fingerprint enforcement available for premium-locked accounts<\/p>\n
### \u2b50 Premium Account Linking (`\/premium`) **FIXING IT**
\nLoginX uses a **two-phase Mojang verification handshake** to let players permanently link their account to their real Mojang\/Microsoft identity:<\/p>\n
1. Player runs `\/premium` \u2192 LoginX queries the Mojang Profiles API to confirm the username exists
\n2. Player is kicked and asked to **reconnect within 60 seconds using the official launcher**
\n3. On reconnect, LoginX verifies the session against **Mojang’s session servers** using a unique token
\n4. If verified \u2192 account is permanently **premium-locked** to the real Mojang UUID
\n5. Premium-locked players are **auto-logged in** on future joins \u2014 no password prompt needed<\/p>\n
This prevents name impersonation: anyone can claim a premium username, but only the real account owner can pass the session server check.<\/p>\n
### \ud83d\udee1\ufe0f Security
\n– **Brute-force protection** \u2014 account is temporarily locked after too many failed login attempts (configurable threshold and ban duration)
\n– **Alt account limiting** \u2014 max registered accounts per IP address
\n– **Anti-replay protection** \u2014 blocks reuse of intercepted authentication tokens
\n– **Console log filtering** \u2014 sensitive auth details are stripped from server logs<\/p>\n
### \ud83d\uddc4\ufe0f Database
\n– Supports **SQLite** (zero-config, default) and **MySQL**
\n– Fully **async database operations** \u2014 no blocking the main thread
\n– Separate tables for player accounts, sessions, and fingerprint change history<\/p>\n
—<\/p>\n
## \u2726 Commands<\/p>\n
| Command | Description | Permission | —<\/p>\n ## \u2726 Permissions<\/p>\n | Permission | Default | Description | —<\/p>\n ## \u2726 Configuration Highlights<\/p>\n “`yaml session: fingerprint: security: database: All messages are fully customizable via `messages.yml`.<\/p>\n —<\/p>\n ## \u2726 Developer API<\/p>\n LoginX exposes a public `LoginXAPI` class for third-party plugin integration. Check session state, listen to auth events, and more. Full documentation is available on the [GitHub repository]([https:\/\/github.com\/abdoabk\/LoginX](https:\/\/github.com\/AbdelrahmanM1\/LoginX)).<\/p>\n —<\/p>\n ## \u2726 Compatibility<\/p>\n | Platform | Status | **Java 17+ required \u00b7 Minecraft 1.20+**<\/p>\n —<\/p>\n ## \u2726 Support & Links<\/p>\n – \ud83d\udcbb **Source code** \u2192 GitHub<\/p>\n > Please do **not** use Modrinth comments for bug reports.<\/p>\n **NOTE** There is problems with “`\/premium“` **I am working on it**<\/p>\n","protected":false},"excerpt":{"rendered":" a secure, modern authentication plugin for Minecraft servers that require players to register and log in. It protects accounts with encrypted passwords, persistent sessions, client fingerprinting, and a two-phase Mojang premium verification system<\/p>\n","protected":false},"featured_media":95284,"template":"","meta":{"_minecraft_slug":"loginx","_minecraft_project_id":"ud9PM8xd","_minecraft_author":"AbdelrahmanM1","_minecraft_license":"LicenseRef-All-Rights-Reserved","_minecraft_downloads":136,"_minecraft_follows":0,"_minecraft_client_side":"unsupported","_minecraft_server_side":"required","_minecraft_storage_type":"zip","_minecraft_archive_name":"loginx.zip","_minecraft_size_bytes":40514867,"_minecraft_version_count":2,"_minecraft_updated_at":"2026-05-15T18:51:32.515219Z","_minecraft_date_created":"2026-03-11T04:26:21.454350Z","_minecraft_date_modified":"2026-02-26T16:49:47.464726Z","_minecraft_project_url":"https:\/\/modrinth.com\/mod\/loginx","_minecraft_icon_attachment_id":95284,"_minecraft_imported_at":"2026-06-05T10:59:07+00:00","_minecraft_import_hash":"e3425f88b2ff8849e32814ea7316cd1c","_minecraft_versions":"","_minecraft_links":"","_minecraft_gallery":"","_minecraft_api_metadata":""},"mod_category":[126,129,92],"mod_loader":[134],"minecraft_version":[59,36,60,93,94,101,102,62,37,40,41,73,74,38,78,79,80,81,82],"class_list":["post-95283","mod","type-mod","status-publish","has-post-thumbnail","hentry","mod_category-management","mod_category-spigot","mod_category-utility","mod_loader-spigot","minecraft_version-1-20","minecraft_version-1-20-1","minecraft_version-1-20-2","minecraft_version-1-20-3","minecraft_version-1-20-4","minecraft_version-1-20-5","minecraft_version-1-20-6","minecraft_version-1-21","minecraft_version-1-21-1","minecraft_version-1-21-10","minecraft_version-1-21-11","minecraft_version-1-21-2","minecraft_version-1-21-3","minecraft_version-1-21-4","minecraft_version-1-21-5","minecraft_version-1-21-6","minecraft_version-1-21-7","minecraft_version-1-21-8","minecraft_version-1-21-9"],"yoast_head":"\n
\n|—|—|—|
\n| `\/register
\n| `\/login
\n| `\/logout` | End your current session | `loginx.player` |
\n| `\/changepass
\n| `\/premium` | Link account to Mojang via 2-phase verification | `loginx.premium` |
\n| `\/loginx reload` | Reload config and messages | `loginx.admin` |
\n| `\/loginx info` | View plugin status and stats | `loginx.admin` |
\n| `\/loginx session
\n| `\/loginx forcepremium
\n|—|—|—|
\n| `loginx.player` | everyone | Basic auth commands |
\n| `loginx.premium` | everyone | Access to `\/premium` |
\n| `loginx.admin` | op | All admin commands |
\n| `loginx.bypass` | false | Skip authentication entirely |<\/p>\n
\nauth:
\n min-password-length: 8
\n login-timeout-seconds: 30
\n password-hash: ARGON2 # or BCRYPT<\/p>\n
\n enabled: true
\n timeout-minutes: 30
\n rolling: true
\n invalidate-on-ip-change: true
\n invalidate-on-fingerprint-change: true<\/p>\n
\n enabled: true
\n max-changes-per-7d: 1<\/p>\n
\n max-accounts-per-ip: 3
\n brute-force:
\n max-attempts: 5
\n temp-ban-minutes: 10<\/p>\n
\n type: sqlite # or mysql
\n“`<\/p>\n
\n|—|—|
\n| Paper 1.20+ | \u2705 Fully supported |
\n| Spigot | \u2705 Supported |
\n| Bukkit | \u26a0\ufe0f May work, not tested |<\/p>\n