🔐 FrozenAuth

📦 Plugin Info

A secure authentication plugin for Paper/Folia/Purpur servers with GeyserMC/Floodgate support. Players are required to register and log in with a password before they can move or interact with the world. Includes a private limbo platform, countdown bossbar, join-message hiding until authenticated, and a GUI-confirmed password reset flow.

• Name: FrozenAuth
• Version: 2.0.1
• Load order: POSTWORLD

👤 Author Info

• Author: DrFrozenXD

✅ Versions / Compatibility / Software Support

• API Version: 1.20
• Built against: Paper API (targeting the 1.26.x line), Java toolchain, Maven build
• Server software: Paper, Folia, Purpur
• Folia support: ✅ Supported (folia-supported: true)
• Soft dependency: Floodgate (optional — enables full GeyserMC/Bedrock Edition support)
• Automatic proxy-auth detection: If a verification layer such as Velocity/BungeeCord with IP forwarding, or a plugin like FastLogin, is present in front of the server, FrozenAuth automatically defers to it — no config changes needed.

🔐 Permissions

Permission	Default	Purpose
frozenauth.register	true	Allows a player to register an account
frozenauth.login	true	Allows a player to log into an account
frozenauth.changepass	true	Allows a player to change their password
frozenauth.reload	op	Allows reloading the plugin's config

⌨️ Commands

Command	Usage	Permission	Description
/register	/register <password> <confirmPassword>	frozenauth.register	Registers a new account
/login	/login <password>	frozenauth.login	Logs into an existing account
/resetpassword	/resetpassword <oldPassword> <newPassword>	frozenauth.changepass	Changes account password, with a GUI confirm/cancel step
/frozenauth reload	/frozenauth reload	frozenauth.reload	Reloads the plugin configuration

Full tab completion is included for all commands.

🎯 Uses

• 🛡️ Requires a password before players can play, protecting accounts and preventing impersonation.
• ✅ Microsoft (premium) accounts and Bedrock Edition players don't need to login or register — they're welcomed through automatically.
• 🧊 Sends players who still need to authenticate to an isolated, private per-player limbo platform (5×5, barrier-blocked) until they finish.
• ⏱️ Configurable authentication timer with a live bossbar countdown; players who run out of time are kicked with a custom title/subtitle.
• 🙈 Optionally hides the "player joined" broadcast until the player has actually authenticated — if they disconnect first, no one ever saw them join.
• 🚫 Freezes movement and applies Blindness during the auth period so players can't peek at or wander through the world before logging in.
• 🎨 Fully customizable messages, titles, bossbar, and GUI text, with hex color (&#RRGGBB) support throughout.
• 🌍 Smart post-auth teleport: sends first-time players and anyone whose last location was the spawn world to spawn, and restores everyone else to their exact last location.
• 🎮 Separate, configurable welcome titles and chat messages for Bedrock Edition and Microsoft (premium) players.

⚙️ Key Config Areas (config.yml)

• auth.* — timer length, blindness, movement freeze, join-message hiding
• limbo.* — spawn world used for post-auth teleport logic
• bedrock.* — Bedrock Edition spawn world, welcome title, and join message
• bossbar.* — countdown bossbar enable, title, color, style
• titles.* — join titles/subtitles shown during the auth period
• messages.* — every user-facing plugin message, including the auth-timeout kick screen
• gui.* — text for the password-reset confirm/cancel GUI
• premium.* — welcome title and join message for Microsoft (premium) accounts 💾 Data & Configuration
• YAML-based configuration with per-world spawn customization
• Persistent player data storage (backward-compatible with v1.x data.yml)
• Reload command for live config updates without restart

🔧 Developer-Friendly

• Maven build system with Java 21 compilation
• Lombok for reduced boilerplate
• Clean, modular architecture
• Extensive javadoc and code comments

Commands

Command	Description	Permission
/register <password> <confirmPassword>	Register a new account	frozenauth.register
/login <password>	Login to existing account	frozenauth.login
/resetpassword <oldPassword> <newPassword>	Change your password	frozenauth.changepass
/frozenauth reload	Reload plugin configuration	frozenauth.reload

All permissions default to true except frozenauth.reload (op-only).

Configuration Highlights

• Per-world spawn location — customize where players spawn after authentication
• Limbo platform customization — choose outer and center block types (default: glass + enchanting table)
• Auth timeout duration — configure how long players have to authenticate
• Join message suppression — hide join messages until players are authenticated
• Gradient message styling — color-coded authentication prompts and feedback

Bedrock Edition Support

GeyserMC/Floodgate players can register and login using the same commands as Java players. Automatic detection ensures smooth cross-platform compatibility.

What's New in v2.0.0

🔄 Major Rework

• Complete architectural overhaul for stability and performance
• Fixed critical bug: new registrations were leaking limbo platform slots
• Fixed: /register now respects limbo.spawn-world config (previously ignored)
• Migrated from deprecated AsyncPlayerChatEvent to modern AsyncChatEvent

🚀 Performance & Compatibility

• Removed hard LuckPerms dependency that was causing boot failures
• Implemented Folia-safe scheduler for all async operations
• Hardened void chunk generator with explicit biome provider
• Fully compatible with Paper 1.21.4–1.21.11+

🎨 UI Improvements

• Password reset GUI redesigned with black border, gradient styling
• Auth-timeout kick screen now uses consistent gradient branding
• Enhanced limbo platform (5×5 with enchanting table center)

Installation

1. Download the latest release JAR
2. Drop into plugins/ folder
3. Restart server or use /reload
4. Configure plugins/FrozenAuth/config.yml to your needs
5. Restart (or /frozenauth reload) for changes to take effect

If migrating from v1.x: Simply drop your backed-up data.yml into plugins/FrozenAuth/ after installing — all player passwords load normally.

Permissions Matrix

Permission	Default	Effect
frozenauth.register	True	Players can register accounts
frozenauth.login	True	Players can login to accounts
frozenauth.changepass	True	Players can reset passwords
frozenauth.reload	Op	Operators can reload configuration

Requirements

• Server Software: Paper/Folia/Purpur 1.20+
• Java: Java 21 (for running the server)
• Dependencies: None required; Floodgate is optional

Support for Verification Layers

If you deploy FastLogin or run a proxy (Velocity/BungeeCord) with real Mojang authentication + modern player forwarding, FrozenAuth automatically uses cryptographic premium verification. Otherwise, it falls back to standard username-based detection — no configuration needed, it adapts automatically.

Known Behavior

• Premium players (registered with Mojang) bypass registration and login automatically
• Unauthenticated players cannot move, use inventory, execute commands, or interact with the world
• Limbo world is completely isolated — other plugins' features (TAB scoreboard, etc.) can be disabled per-world in their configs
• Join/quit messages are suppressed for unauthenticated sessions

Development & Contributions

Built with:

• Paper API 1.21.11-R0.1-SNAPSHOT
• Lombok 1.18.30 (for clean code)
• GeyserMC Floodgate 2.2.2 (optional, soft dependency)

Author

---

FrozenAuth v2.0.0 — Robust authentication for the modern Minecraft server.