LoginSystem

# 🔐 LoginSystem — Authentication System for Paper

LoginSystem is a complete authentication system for Minecraft servers based on Paper, designed to protect player accounts through registration, login, authentication protection, and compatibility with Java and Bedrock players.

The plugin is specifically designed for servers that use a Lobby as the entry point and multiple worlds through systems like Multiverse or MyWorlds.

Its main purpose is to allow a player to join the server, be directed to the lobby, authenticate securely, and then select the world they wish to access, preventing the accidental loading of inventory or world data into the lobby.

---

# ✨ Main Features

## 🔐 Registration System

Players without a registered account can use:

/register <password> <password>

The plugin securely stores the password and allows it to be used later to log in.

Example:

/register MyPassword123 MyPassword123

 

# 🔑 Login System

Registered players must authenticate using:

/login <password>

Example:

/login MyPassword123

Until authentication is complete, the player remains protected and cannot access the server normally.

 

# 🌐 Java and Bedrock Support

LoginSystem allows you to independently configure the behavior of Java and Bedrock players.

### Java

.yml
java:
enabled: false
auto-register: false
auto-login: false

These options are disabled by default.

This allows you to decide whether the authentication system applies to Java players and whether they should use automatic registration/login.

### Bedrock

.yml
bedrock:
enabled: true
auto-register: true
auto-login: true

The system can identify players connected via Bedrock and apply different behavior than for Java.

This allows traditional authentication to be used for Java players, while Bedrock players can use automatic registration and login.

 

# ⚙️ Enable or disable the system completely

The plugin has a global option:

.yml
settings:
enabled: true

If it is configured as:

.yml
settings:
enabled: false

the authentication system is disabled without needing to remove the plugin.

This allows you to quickly enable or disable LoginSystem from the settings.

 

# ⏱️ Timeout System

LoginSystem includes a timer to prevent a player from remaining indefinitely without authenticating.

Example:

.yml
settings:
timeout-seconds: 60

The player will have 60 seconds to register or log in.

If the time reaches zero, the plugin can automatically kick them from the server.

 

# 📊 Visual Timer

The remaining time can be displayed using a BossBar, ActionBar, or both.

Configuration:

.yml
settings:
timeout-seconds: 60
timeout-display: bossbar
show-time-remaining: true

Available Options:

bossbar
actionbar
both
none

Visual Example:

🔐 Time to Authenticate: 45 seconds

 

The BossBar updates automatically while the player is not authenticated.

When the player completes the login or registration, the timer and BossBar disappear.

 

# 🏠 Authentication Lobby System

One of the main goals of the plugin is to use a specific world as an authentication lobby.

The flow is:

Player enters the server

↓
LoginSystem detects the player

↓
Player is sent to the Lobby

↓
Player must register or log in

↓
Authentication complete

↓
Player remains in the Lobby

↓
Player selects a world

↓
Enters the selected world

The player is not automatically sent back to the previous world after logging in.

This allows the lobby to be used as the server's main menu.

 

# 🎒 Inventory Protection

LoginSystem is designed to prevent one of the most common problems with authentication systems on servers with multiple worlds:

> The player enters the lobby, logs in, and temporarily appears with the items they had in another world.

This can lead to inventory loss or contamination when the server uses separate inventories for each world.

The system prevents directly restoring the previous world's inventory within the lobby when an external system manages inventories.

 

# 🌎 Multiverse Compatibility

LoginSystem supports servers using:

Multiverse-Core

and

Multiverse-Inventories

Authentication should not interfere with the per-world inventory system.

The recommended workflow is:

OneBlock

↓
Player disconnects

↓
Server saves its state

↓
Player returns

↓
Lobby

↓
Login

↓
Select OneBlock

↓
Multiverse

 

-Inventories

↓ Load OneBlock Inventory

This way, the player should not receive OneBlock items within the lobby.

 

# 🌍 MyWorlds Compatibility

The system is also prepared for servers that use MyWorlds.

This is especially important because some servers do not use Multiverse-Inventories to manage their inventories.

The idea is that LoginSystem will not force the restoration of the previous inventory while the player remains in the lobby.

When the player later switches to the corresponding world, the world/inventory management system can load the data for that world.

 

# 🛡️ Authentication Protection

While the player is not authenticated, LoginSystem can prevent actions that would allow bypassing the security system.

The goal is to prevent a player from taking advantage of the pre-login period to interact normally with the server.

The system is designed to work in conjunction with the authentication lobby.

 

# 🔄 Configuration Reload

It is not necessary to delete `config.yml` to apply new configurations.

The plugin allows you to reload the configuration using:

/authadmin reload

This allows you to modify:

 

and then execute:

/authadmin reload

The values ​​are reloaded without reinstalling the plugin.

 

# 🧩 Automatic Configuration Migration

An important feature of the project is that new options added in future versions can be incorporated into the existing `config.yml`.

For example, if a new version adds:

.yml
java:
enabled: false
auto-register: false
auto-login: false

a server that already had a previous `config.yml` shouldn't need to delete it.

The plugin can preserve the existing configuration and add any missing new values.

This prevents losing custom configurations during updates.

 

# ⚙️ Separate Configuration

LoginSystem separates several functions to allow for flexible configuration.

Example:

.yml
settings:
enabled: true
timeout-seconds: 60
timeout-display: bossbar
show-time-remaining: true

java:
enabled: false
auto-register: false
auto-login: false

bedrock:
enabled: true
auto-register: true
auto-login: true

This allows you to configure different behaviors depending on the type of player.

 

# 🎮 Recommended Full Flow

For a server with Lobby + OneBlock + other worlds:

text

┌─────────────────┐

│ Player enters │

└────────┬────────┘

│

▼

┌────────────────┐

│ LoginSystem │
│ Activated? │

└────────┬────────┘

│

▼

┌────────────────┐

│ LOBBY

└────────┬────────┘

│

▼ 

┌──────────────────────┐ 
│ Are you authenticated? │

└──────────┬───────────┘

│
NO │ YES

↓

│

┌───────────┐

│ Register/

│ Login

│

└─────┬─────┘

│

▼

│
┌───────────┐ │
│ Authenticated│◄──┘
└─────┬─────┘
│

▼
┌─────────────┐
│ LOBBY │
└──────┬──────┘
│
Select world
│
┌─────────┼─────────┐
▼ ▼ ▼
OneBlock World Survival
│ │ │
▼ ▼ ▼
Inventory Inventory Inventory

Correct Correct Correct

# 🧠 System Philosophy

LoginSystem clearly separates two responsibilities:

### LoginSystem

It handles:

* Registration.

* Login.

* Player identification.

* Protection during authentication.

* Timeout.

* Authentication lobby.

* Java/Bedrock differentiation.

* Configuration.

* Configuration reload.

### Worlds/Inventory System

It handles:

* Current world.

* World inventory.

* Ender Chest per world.

* World-specific state.

* Teleportation.

* World management.

This separation prevents the authentication system from attempting to manage inventories that actually belong to plugins like Multiverse-Inventories or MyWorlds.

 

# 🧱 Compatibility

The project is geared towards:

Minecraft Paper 26.2

and is designed to function as a server plugin.

The architecture allows for future expansion of the system with new integrations and functionalities.

 

# 🚀 Possible enhancements

The plugin architecture allows for the future addition of functionalities such as:

* `/changepassword`
* `/logout`
* `/unregister`
* Brute-force protection.

* Temporary lock after several incorrect attempts.

* Maximum number of login attempts.

* Configurable password hash.

* Customizable messages.

* Placeholder API support.

* Authentication GUI menu.

* Discord integration.

* MySQL/MariaDB database integration.

* Account synchronization across servers.

* Support for BungeeCord/Velocity servers.

* Persistent sessions.

* Login via IP/session.

* CAPTCHA system.

* Registration via GUI.

* Password recovery system.

 

# 📌 Summary

LoginSystem is an authentication system designed for modern Minecraft servers that need to control access for Java and Bedrock players from a lobby.

Its main objectives are:

🔐 Security

Protects the player until registration or login is complete.

🌐 Java + Bedrock

Allows for independent configuration of both player types.

🏠 Lobby

The player authenticates in the lobby before accessing other worlds.

🎒 Secure Inventories

Prevents accidentally restoring another world's inventory within the lobby.

🌎 Multiworld

Designed to coexist with systems like Multiverse and MyWorlds.

⏱️ Timeout

Controls how much time the player has to authenticate and displays the remaining time visually.

⚙️ Flexible Configuration

Allows you to enable/disable features from `config.yml`.

🔄 Reload

Allows you to modify the configuration without reinstalling the plugin using:

`/authadmin reload

📦 Updates

The configuration can evolve through automatic migrations without requiring the administrator to delete their `config.yml`.

---

## 🎯 Final Goal

The ideal behavior of the plugin is simple:

> The player enters → appears in the Lobby → registers or logs in → sees the counter while unauthenticated → completes authentication → remains in the Lobby → selects a world → the world system correctly loads all the data and inventory corresponding to that world.