🛡️ UltimateAuth - Enterprise Minecraft Authentication & Security

UltimateAuth is a flagship, high-performance authentication and account defense engine designed from the ground up for modern Minecraft networks (1.20 - 1.21.4+). Built on non-blocking async architecture, it safeguards your player accounts and server infrastructure against credential stuffing, bot connection spam, password guessing, and rogue access.

⚡ What Makes UltimateAuth Superior?

🚀 Key Features

1. 🔒 Enterprise Brute-Force & Dictionary Defense

• Progressive Rate Limiting: Tracks failed authentication attempts per player and IP.
• Account & IP Lockout: Temporarily locks accounts after configurable attempts (default: 5 attempts -> 15 min cooldown).
• Anti-Bot Connection Throttle: Built-in connection-level burst gate (global-max-per-second and ip-window).

2. 🛡️ Advanced Password Policy

• Blocks trivially vulnerable passwords (123456, password, minecraft, admin, etc.).
• Prevents players from setting passwords that contain or match their username.
• Configurable minimum length and strict max limit (72 characters for BCrypt safety).

3. 🚨 Discord Security Webhook Integration

• Non-blocking HTTP client notifies staff channels instantly when:
  • An administrator or OP account logs in.
  • A brute-force lockout is triggered on any account.
  • An account password is changed or updated.
• Automatically masks sensitive IP addresses (192.168.1.***) for privacy compliance.

4. 👁️ Immersive Blindness & Visual Lockdown

• Gives unauthenticated players a temporary blindness effect to prevent previewing hub builds, secrets, or player positions.
• Smoothly freezes player coordinates and orientation without irritating client-side rubberbanding.

5. 🗄️ Multi-Storage Architecture

• SQLite (Default): Lightning-fast, zero-configuration local database powered by HikariCP.
• MySQL & MariaDB: Enterprise connection pool for multi-server networks and BungeeCord/Velocity setups.
• Secure Password Hashing: Military-grade BCrypt hashing with configurable cost factor (default: 12).

📜 Commands & Permissions

Player Commands

Administrator Commands

⚙️ Configuration (config.yml)

# Connection-level anti-bot & account defense.
security:
  connection:
    enabled: true
    global-max-per-second: 80
    ip-max-attempts: 8
    ip-window: 10s
    kick-message: "<red><bold>Slow down</bold></red><gray> • Too many connection attempts, retry in a few seconds.</gray>"

  # Progressive brute-force protection and lockout
  brute-force:
    max-attempts: 5
    lockout-minutes: 15

  # Real-time Discord security alerts (Admin logins, lockouts, password modifications)
  webhook:
    enabled: false
    url: ""

# Authentication module.
auth:
  enabled: true
  login-timeout: 120
  chat-reminder-interval: 10s
  bcrypt-cost: 12

  # Password strength and credential safety rules
  password-policy:
    min-length: 6
    disallow-username: true
    disallow-common: true

  # Visual privacy and spawn protection
  visuals:
    blindness: true

  session-enabled: true
  session-duration: 30m

  database:
    type: sqlite # mysql, mariadb, sqlite
    pool-size: 10
    sqlite:
      file: auth.db

🔧 Installation

1. Drop UltimateAuth-3.3.0.jar into your server's plugins/ directory.
2. Start the server to generate plugins/UltimateAuth/config.yml.
3. Configure your database settings (or use default zero-config SQLite) and Discord webhook.
4. Enjoy rock-solid, zero-lag server authentication!