---

What is SideGate?

SideGate is a Bukkit-compatible plugin (Spigot/Paper/Folia/Purpur) designed for servers that want to keep online-mode=true while selectively allowing administrator-approved guest accounts.

Authenticated players continue using the server's standard login flow, while approved guest accounts are handled through configurable SideGate access policies.

When Floodgate or Geyser-Spigot is installed, detected Bedrock players remain on the Bedrock authentication path and are not treated as SideGate guests.

SideGate 2.0.0 can also run on Bukkit backends behind SideGate for Velocity. Velocity handles the login decision while Bukkit applies Guest messages and gameplay settings.

Why use SideGate?

• Keep standard online-mode behavior for authenticated players.
• Avoid changing the entire server authentication mode.
• Control exactly which guest accounts may join.
• Apply restrictions and visual labels to guest accounts.

---

Core Features

• Selectable Login Engine: login-engine can use ProtocolLib, the built-in engine, or pick automatically (auto).
• Hybrid Login Flow: Authenticated players use the standard server login process, while approved guest accounts follow SideGate access rules.
• Manual Account Override: premium-usernames can always follow the standard login path.
• Account Session Failure Policy: Compare the login UUID with Mojang before encryption, then show a custom name-conflict message or continue as Guest.
• Guest Admission Policy: Use allow-all-guests or allowed-guests.
• Optional Account Detection: Optional account status lookup with internal cache (auto-detect-premium).
• Floodgate/Geyser Support: Automatically bypass guest classification for detected Bedrock players when either Bukkit plugin is installed.
• Fail-Closed Authentication: If the account lookup fails, players stay on the standard online-mode login instead of being granted guest access.
• Guest Handling: Apply guest tags, GameModes, titles, subtitles, and messages.
• Guest Chat Prefix: Prefix applies to guest-tagged players only.
• Runtime Reload: /sidegate reload.
• Public API: Addon plugins can integrate through SideGate API services.
• Velocity Backend Mode: Use proxy-mode.enabled to separate proxy authentication from Bukkit Guest actions.

---

Installation

Optional dependency: ProtocolLib (SpigotMC)
https://www.spigotmc.org/resources/protocollib.1997/

1. Optionally install ProtocolLib (5.x+). Without it, SideGate uses its built-in login engine.
2. Optionally install Floodgate and/or Geyser-Spigot for automatic Bedrock detection.
3. Put the SideGate .jar file in your /plugins folder.
4. In standalone Bukkit mode, set online-mode=true in server.properties.
5. Start or restart the server.

---

Configuration Example

# SideGate Configuration

enable-guest-mode: true

login-engine: auto # or protocollib / builtin

proxy-mode:
  enabled: false

auto-detect-premium: true

allow-all-guests: true

premium-usernames:
  - "TamKungZ"

premium-session-failure:
  action: "KICK_WITH_MESSAGE" # or FALLBACK_TO_GUEST
  message: "&cThis username belongs to a Premium account.\n&eChange your username and try again."

allowed-guests:
  - "FriendName1"
  - "FriendName2"

guest-settings:
  default-gamemode: "SURVIVAL"
  chat-prefix: "&7[Guest] &r"

messages:
  join-title: "&cACCESS RESTRICTED"
  join-subtitle: "&7Guest Mode"
  join-message:
    - "&c=================================="
    - "&6 Welcome to SideGate Protocol"
    - "&7 Account Status: &cGuest (Non-License)"
    - "&7 You have restricted gameplay access."
    - "&c=================================="

---

Requirements

• Java: 17+
• Server: Spigot / Paper / Folia / Purpur (Bukkit-compatible)
• Optional dependency: ProtocolLib 5.x+ (SpigotMC) (GitHub)
• Optional integrations: Floodgate, Geyser-Spigot

---

Bug Reports

Submit issues at:

https://github.com/TamKungZ/SideGate/issues

Please include:

• Server software + exact version
• Java version
• ProtocolLib version
• SideGate version
• Relevant startup/login logs

---

Project Status & License

Closed Source

• Normal server usage is allowed.
• Separate addon plugins using the SideGate public API are allowed.
• Modification, redistribution, or repackaging is not allowed without permission.
• Commercial use or monetization requires prior permission via email: dev@tamkungz.me

Public reference snapshot:

https://github.com/TamKungZ/SideGate (sidegate-1.0.0-rc.1)

---

Security Notice

Guest account access may introduce identity verification limitations. For production servers, use an authentication plugin and a strict permission setup.

If the account lookup is unavailable, SideGate does not assume the player is a guest. The server's standard online-mode login remains responsible for the connection.

FALLBACK_TO_GUEST is a high-risk server-wide policy. It allows unverified clients to join with a username that is registered to an official account, using a Guest UUID. Use an authentication plugin and UUID-based permissions.

The session failure policy requires auto-detect-premium: true.

A client that deliberately spoofs the exact official UUID remains on standard online-mode authentication and cannot bypass Mojang session verification.

When using Velocity, configure secure player forwarding and never expose backend ports publicly. Keep Velocity online-mode=true and set Bukkit backends to online-mode=false. SideGate Velocity requires player-info-forwarding-mode="modern" and preserves login results already set by Floodgate or another proxy authentication plugin.

The encrypted-session FALLBACK_TO_GUEST mode is available only in standalone Bukkit mode. Velocity-routed usernames registered to official accounts must pass normal Mojang session verification, but SideGate Velocity can replace the generic invalid-session response with a configurable message.