# rAuth - 3.0.1 --- * **Fixed Bugs** > **Join our [Discord](https://discord.gg/mm7rgaNsGe) to report bugs, request features, or get support.**

# rAuth - 3.0.0 --- * **Console password masking is now always enabled.** * Passwords entered through the console are automatically masked using both **Log4j and JUL**. * The `mask-console-passwords` configuration option has been removed. * Console password masking is now installed automatically when rAuth starts, providing permanent protection against accidentally exposing passwords in console logs. * **Added Universal Database Support with 6 database engines.** * rAuth now supports: * FlatFile * MySQL * MariaDB * PostgreSQL * SQLite * H2 * Database connections now use **HikariCP connection pooling** where applicable. * Added automatic database migration support, including automatic schema updates when required. ```yaml database: type: flatfile # Supported: # flatfile # mysql # mariadb # postgresql # sqlite # h2 ``` * **Added Forum & Web Database Synchronization.** * rAuth can now synchronize player authentication data with external forum and website databases. * Supported platforms include: * XenForo * MyBB * phpBB * WordPress * WBB * and other compatible systems * Added support for **15 password hash types**: * BCRYPT * BCRYPT2Y * MD5 * SHA1 * SHA256 * SHA512 * DOUBLE_MD5 * SALTED_SHA512 * MYBB * PHPBB * WORDPRESS * XENFORO * WBB4_BCRYPT * ARGON2 * PLAIN * Added multiple synchronization modes including: * Write-through on registration * Write-through on password change * Primary authentication * Import-on-join ```yaml forum-sync: enabled: false # Configure your external forum/web database here. ``` * **Added Krsna AI Assistant.** * rAuth now includes a built-in AI assistant accessible through: * `/rauthai` * `/krsna` * Added support for **17 AI providers**, including: * Gemini * OpenRouter * OpenAI * Cloudflare * Groq * Anthropic * Fireworks * Mistral * Together * Cerebras * Braintrust * HuggingFace * Anyscale * DeepInfra * Lepton * Replicate * DeepSeek * Added built-in API keys for supported providers. * Added a local `knowledge.yml` knowledge base using RAG. * AI-generated configuration changes require **[Apply] confirmation** before being applied. * Added per-user AI rate limiting. * Added automatic idle disabling to prevent unnecessary API usage. ```yaml ai: enabled: true # Configure your preferred AI provider here. ``` * **Added Rejoin Grace Period.** * Players can now receive a one-time grace period when reconnecting from the same IP. * A player who reconnects within the configured period can skip the password prompt. * Default grace period: **5 minutes**. ```yaml rejoin-grace: enabled: true minutes: 5 ``` * **Added Auto-Login Quick Reconnect.** * Players can automatically restore their authenticated state when quickly reconnecting from the same IP. * Default duration: **60 minutes**. * This is separate from the normal Session Login system. ```yaml auto-login: enabled: true timeout-minutes: 60 ``` * **Added Discord Password Recovery.** * Players can now recover their account through Discord using verification codes. * Added commands for setting up and verifying Discord recovery: * `/forgotpass setdiscord` * `/forgotpass verifydiscord` * `/forgotpass discord` * `/forgotpass discordcode` * Discord recovery works independently from regular Discord webhook notifications. * **Added Standalone Anti-VPN Protection.** * rAuth can now detect VPN, proxy, and hosting connections without requiring another external plugin. * Added automatic provider selection with: * `auto` * `external` * `standalone` * Added separate proxy and hosting detection options. * Detection results are cached for **12 hours** to reduce unnecessary API requests. ```yaml anti-vpn: enabled: true provider: auto check-proxy: true check-hosting: true cache-hours: 12 ``` * **Added Live Config Editing.** * Administrators can now view and modify configuration values directly in-game without manually opening `config.yml`. ```text /rauth config get <path> /rauth config set <path> <value> /rauth config list ``` * Added tab completion for configuration paths and commands. * **Improved Bot Protection.** * Added a configurable bot-question repeat interval. * Bot verification questions can now automatically repeat while the challenge is active, ensuring that the verification challenge does not disappear before the player completes it. ```yaml bot-protection: repeat-interval-seconds: 5 ``` * **Expanded Admin Commands.** * Added new administration commands and management options for: * Login history * Account unregistering * IP unblocking * Server stop/restart * Authentication spawns * Password resets * Session management * Session clearing * Account transfer * AI model switching * New session management commands: ```text /rauth sessions /rauth clearsessions ``` * Added account transfer functionality: ```text /rauth transfer ``` * Added AI model management: ```text /rauth model current /rauth model change ``` * **Improved overall security, authentication and configuration architecture.** * Expanded database compatibility. * Improved external authentication synchronization. * Improved password security. * Improved reconnect handling. * Improved bot protection. * Added AI-powered assistance and configuration management. * Added more administrative controls. * Continued the goal of making every major part of rAuth highly configurable. > **Join our [Discord](https://discord.gg/mm7rgaNsGe) to report bugs, request features, or get support.**

# rAuth - 3.0.0 --- * Added Two-Factor Authentication using TOTP, compatible with Google Authenticator and similar authenticator applications. ```yaml # ============================= # TWO-FACTOR AUTHENTICATION # ============================= two-factor: enabled: true issuer: rAuth code-length: 6 code-ttl-seconds: 30 max-attempts: 5 lock-minutes: 10 require-on-auto-login: true timeout-seconds: 60 bossbar-title: '&aTwo-Factor Authentication' ``` Commands: ```text /2fa <enable|disable|code> /totp <enable|disable|code> /twofactor <enable|disable|code> ``` * Added Argon2id password hashing as an alternative to BCrypt. ```yaml # ============================= # ARGON2ID PASSWORD HASHING # ============================= argon2: enabled: false iterations: 3 memory-kib: 65536 parallelism: 2 upgrade-legacy-hashes: true ``` * Added email-based password recovery using one-time SMTP verification codes. ```yaml # ============================= # EMAIL PASSWORD RECOVERY # ============================= email-recovery: enabled: false smtp: host: smtp.example.com port: 587 ssl: false starttls: true username: '' password: '' from: '' from-name: rAuth code-length: 6 code-ttl-minutes: 10 max-attempts: 5 resend-cooldown-seconds: 60 forgot-pass: methods: email: true ``` Commands: ```text /forgotpass setemail <email> /forgotpass email <email> /forgotpass emailcode <code> ``` * Added name-change detection and account data transfer. rAuth can detect when a player changes their Minecraft name and allows administrators to transfer account data between names. ```yaml # ============================= # NAME CHANGE DETECTION # ============================= name-change: enabled: true auto-detect: true notify-admins: true update-stored-name: true ``` Command: ```text /rauth transfer <oldName> <newName> ``` * Added Discord webhook notifications for security and login events through `WebhookNotifier`. ```yaml # ============================= # DISCORD SECURITY WEBHOOKS # ============================= discord-webhooks: enabled: false webhook-url: '' username: rAuth avatar-url: '' timeout-seconds: 10 queue-capacity: 100 events: join: true login: true register: true wrong-password: true ip-blocked: true bot-banned: true name-change: true geo-blocked: true register-flood: true brute-force-wave: true ``` * Added Redis multi-server synchronization for bans, account locks, bot bans, bot sessions, whitelists, blacklists, and related authentication data. ```yaml # ============================= # REDIS MULTI-SERVER SYNC # ============================= redis: enabled: false host: localhost port: 6379 password: '' database: 0 timeout-seconds: 5 key-prefix: rauth: sync-interval-seconds: 5 sync: ip-bans: true subnet-bans: true account-locks: true bot-bans: true bot-sessions: true whitelists: true blacklists: true ``` * Added PlaceholderAPI support with rAuth placeholders. ```yaml placeholders: enabled: true ``` Available placeholders include: ```text %rauth_status% %rauth_registered% %rauth_lastlogin% %rauth_2fa_enabled% %rauth_session_active% %rauth_language% %rauth_ip% ``` * Added per-player language selection with 8 bundled locales: English, German, Spanish, French, Hindi, Portuguese, Russian, and Chinese. ```yaml # ============================= # PLAYER LOCALES # ============================= locales: enabled: true default-locale: en available: - en - de - es - fr - hi - pt - ru - zh ``` Command: ```text /language <code> /lang <code> /locale <code> ``` * Added an interactive Setup Wizard GUI for configuring rAuth directly in-game. ```yaml # ============================= # SETUP WIZARD # ============================= setup-wizard: enabled: true title: '&a&l rAuth Setup' main-title: '&8rAuth Configuration' ``` Command: ```text /rauth setup ``` * Added anonymous bStats metrics through `MetricsManager`. ```yaml # ============================= # BSTATS METRICS # ============================= metrics: enabled: true plugin-id: 0 ``` * Added saved sessions, allowing players to use a "remember me" option for a configurable number of days. ```yaml # ============================= # SAVED SESSIONS # ============================= session: enabled: true login-flag: -s max-days: 30 max-sessions-per-player: 5 auto-login: true bypass-bot-protection: false show-tip: true ``` Command: ```text /login <password> -s ``` * Added a rejoin grace period. Players who quickly reconnect from the same IP can skip entering their password again during the configured grace period. ```yaml # ============================= # REJOIN GRACE PERIOD # ============================= rejoin-grace: enabled: true period-minutes: 5 ``` * Added password reset functionality for administrators and players who successfully complete the recovery verification flow. Commands: ```text /rauth resetpass <player> /rauth newpass <newpassword> ``` The password reset flow is protected by the recovery verification system. * Added administrator session inspection and session purge commands. ```text /rauth sessions /rauth sessions [player] /rauth clearsessions /rauth clearsessions [player] ``` Session-related limits use the existing `session.*` configuration. * Added a version information command. ```text /rauth version ``` The Bot Protection history can be viewed through `/auth`. * Added pre-authentication restrictions for block breaking, block placing, and general player interaction through `LobbyRestrictionsListener`. These restrictions are hard-blocked for security and do not have a configuration toggle. See the `restrictions:` comment in `config.yml` for details. * Added hunger and food-level cancellation while a player is unauthenticated. This is hard-blocked for security and does not have a configuration toggle. * Added console password masking using Log4j and JUL filters. ```yaml mask-console-passwords: true ``` * Added flat-file storage fallback. rAuth can now operate without MySQL by using local flat-file caches. ```yaml mysql: enabled: false ``` When MySQL is disabled, rAuth uses flat-file storage for data such as: ```text users last-location sessions recovery emails ``` * All the dependencies are optional but reccomended otherwise some feature like Bedrock & Premium auto bypass will not work. * Updated and improved the version update notification message. * Added new sound effects throughout the plugin, with configurable sound settings. * Expanded configuration support across the plugin. Chat messages, sounds, authentication systems, recovery methods, security features, storage, webhooks, Redis synchronization, locales, sessions, and other feature settings can be configured from `config.yml`. > **Join our [Discord](https://discord.gg/mm7rgaNsGe) to report bugs.**

# rAuth - 2.7.0 --- - Fixed Bugs > **Join our [Discord](https://discord.gg/mm7rgaNsGe) to report bugs.**

# rAuth - 2.7.0 --- - Added Bot Protection. ```yaml # ======================================================= # Bot Protection System # ======================================================= bot-protection: # Main switch to turn ON/OFF the entire Bot Protection System enabled: true max-attempts: 5 kick-after: 5 ip-ban-after: 15 ip-ban-time: 30m block-time-multiplier: enabled: true multiplier: 2 # Session Verification Bypass Window (in minutes) # If a verified player rejoins within this window, bot verification is skipped. session-timeout-minutes: 20 # Post-Verification Action kick-on-success: true success-kick-message: '&a&lVerified! &ePlease rejoin the server to authenticate.' # Bot Protection Bypass Configurations bypass: premium: true whitelisted-countries: true whitelisted-continents: true whitelisted-ips: true # Custom choice questions asked on a single line. Either choice is valid. # The system randomizes questions without immediate repetition. choice-questions: - question: Messi or Ronaldo? options: - Messi - Ronaldo - question: Cats or Dogs? options: - Cats - Dogs - question: Pizza or Burger? options: - Pizza - Burger - question: Summer or Winter? options: - Summer - Winter - question: MrBeast or T-Series? options: - MrBeast - T-Series - question: Windows or Linux? options: - Windows - Linux - question: Coffee or Tea? options: - Coffee - Tea messages: prefix: '&a&lrAuth&7» ' start: '&ePlease answer the following question to verify you are human:' invalid-answer: '&cInvalid response! Please type one of the given choices.' kick-message: '&cYou have been kicked for too many invalid bot verification responses.' ban-message: '&cYour IP has been temporarily banned for %time% due to failing bot verification.' remaining-attempts: '&cAttempts left before action: &e%left%' sounds: question-shown: BLOCK_NOTE_BLOCK_PLING success: ENTITY_PLAYER_LEVELUP invalid-answer: ENTITY_VILLAGER_NO kick: ENTITY_VILLAGER_DEATH ban: ENTITY_ENDER_DRAGON_GROWL spawn: world: world x: -45.8830560260036 y: 95.0 z: -2.882257117741117 yaw: 167.97032 pitch: 47.75597 ``` - Now, two or more players with the same name cannot join the server simultaneously. ```yaml already-online-protection: enabled: true kick-message: '&cThis player is already in game!' ``` - Turned off IP Auto Login by default (you can turn it back on from `config.yml`). ```yaml login-gamemode: ADVENTURE premium-bypass: true ip-auto-login: false bedrock-bypass: true ``` - Added an option to whitelist and block entire countries and continents (can be turned on or off from `config.yml`). ```yaml # ============================================================= # GEOGRAPHIC COUNTRY & CONTINENT FILTER # ============================================================= country-filter: enabled: false kick-message: '&cConnections from your country (%country%) are blocked!' blocked-countries: - KP - PK whitelisted-countries: - IN - RU # Whitelisted countries bypass bot protection and authentication entirely whitelisted-auto-login: title: '&a&lVerified Region' subtitle: '&7Auto-logged in from %country%!' sound: ENTITY_PLAYER_LEVELUP continent-filter: enabled: false kick-message: '&cConnections from your continent (%continent%) are blocked!' blocked-continents: - whitelisted-continents: - ``` - Added a notification message for admins when a player logs in from a new IP. ```yaml ip-warning: # Enable or disable the IP warning system for administrators (rlogin.admin) enabled: true message: - '&e--------------------------------------------------' - '&c&l[ADMIN SECURITY WARNING] &eYou logged in from a new IP!' - '&7Last Login: &f%last_date%' - '&7Last IP: &f%last_ip%' - '&7Last Location: &f%last_location%' - '&e--------------------------------------------------' ``` - Added an option to block weak passwords. ```yaml # ===================================== # WEAK PASSWORD PROTECTION # ===================================== password-rules: min-length: 6 max-length: 20 require-numbers: true require-uppercase: false require-special: false blacklist: - '12345' - '123456' - '12345678' - password - qwerty - abcdef messages: blacklisted: '&cPassword rejected! This password is too common and insecure.' require-numbers: '&cPassword rejected! Must contain at least one number.' require-uppercase: '&cPassword rejected! Must contain at least one uppercase letter.' require-special: '&cPassword rejected! Must contain at least one special character.' ``` - Added a password recovery option, using `/forgot`, `/forgotpass`, or `/forgotpassword`. Players can first set a recovery question and its answer. If they use these commands again while logged in, they can change their question and answer. If a player uses these commands before logging in, their saved recovery question will be asked by rAuth. They must answer it using `/forgotpass answer <answer>`. If the answer is correct, the player will be granted permission to change their password using `/rauth newpass <newpass>` **one time only**. To use this feature again, the player must repeat the same recovery process. ```yaml # ============================= # RECOVERY (Forgot Password) # ============================= forgot-pass: messages: prefix: '&a&lrAuth &r&b[Recovery] &7» ' no-recovery: '&cNo security question set! Since you are not logged in, you cannot recover your password.' setup-prompt: '&eTo secure your account, set up a recovery question: &b/forgotpass setup <question> | <answer>' change-prompt: '&eTo change your recovery details, use: &b/forgotpass change <current_answer> | <new_question> | <new_answer>' setup-success: '&aSecurity question configured successfully!' setup-usage: '&eUsage: /forgotpass setup <question> | <answer>' already-logged: '&cYou are already logged in. To change recovery, use &e/forgotpass change <current_answer> | <new_question> | <new_answer>' question-prompt: '&eSecurity Question: &f%question%&e. Answer with &b/forgotpass answer <answer>' incorrect-answer: '&cIncorrect recovery answer!' correct-answer: '&aRecovery correct! You now have permission to run &e/rauth newpass <newpassword> &aonce.' newpass-usage: '&eUsage: /rauth newpass <newpassword>' newpass-no-permission: '&cYou do not have permission to run this command! Verify security question first.' change-success: '&aSecurity question and answer updated successfully!' change-usage: '&eUsage: /forgotpass change <current_answer> | <new_question> | <new_answer>' ``` - Dependencies are now optional. - Mixed and changed the version update message. - Added new SFX, which can be turned on or off from `config.yml`. - Every single thing, from chat messages to SFX to the entire feature set, is configurable. > **Join our [Discord](https://discord.gg/mm7rgaNsGe) to report bugs.**

# rAuth - 2.6.5 --- - Added new config options to turn off/on and change rAuth's sfx. - Now players can't drop ther items/change their hotbar/access to inventory items. > **Join our [Discord](https://discord.gg/mm7rgaNsGe) For Reporting Bugs**

# rAuth - 2.6.4 --- - Added a chat message that notifies players when they are using an outdated version of rAuth and provides the latest version available. - Added console messages related to version updates. > **Join our [Discord](https://discord.gg/mm7rgaNsGe) For Reporting Bugs**

# rAuth - 2.6.3 --- - Hook Between rAuth & FastLogin Has Fixed. ## Given Video Shows The Right Way To Setup Premium/Bedrock/PE Bypass: <iframe width="560" height="315" src="https://www.youtube-nocookie.com/embed/n1ax53oNhsU" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" allowfullscreen></iframe> > **Join our [Discord](https://discord.gg/YbAsbBJvG8) For Reporting Bugs**

# rAuth - 2.6.2 --- - Premium Auto-Login issue Fixed. ## Given Video Shows The Right Way To Setup Premium/Bedrock/PE Bypass: <iframe width="560" height="315" src="https://www.youtube-nocookie.com/embed/n1ax53oNhsU" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" allowfullscreen></iframe> > **Join our [Discord](https://discord.gg/YbAsbBJvG8) For Reporting Bugs**

# rAuth - 2.6.1 --- - Added Advance Chat Authorization. - Fix Small Bugs. > **Join our [Discord](https://discord.gg/YbAsbBJvG8) For Reporting Bugs**