PAL Proxy

PAL Proxy is the Velocity/BungeeCord companion addon for PAL. It protects proxy networks before players reach backend servers, routes unauthenticated players to auth, remembers their requested destination, validates signed PAL sessions and handles proxy-side premium/Bedrock identity decisions.

Addon notice: PAL Proxy is not a standalone authentication plugin. It requires PAL on a Bukkit-compatible auth server and a shared bridge configuration.

Beta notice: PAL Proxy 0.1.0 is intended for staging and controlled beta networks. Test Velocity/BungeeCord, Redis/SQL bridge behavior and failover rules on your own topology before public production use.

What PAL Proxy adds

PAL handles the account and session system on Bukkit. PAL Proxy adds the network guard in front of your backend servers. It decides whether a connecting player already has a valid signed session, whether a verified premium or Bedrock identity may create one, and where the player should be sent next.

It supports Velocity and BungeeCord from one shared proxy core, with optional hooks for FastLogin and Floodgate.

Main features

• Proxy-side auth guard for protected backend servers.
• Velocity and BungeeCord support.
• Auth redirect for unauthenticated players.
• Remembered destination handoff after authentication.
• Verified Java premium identity support.
• Bedrock identity detection through Floodgate.
• Optional proxy-created sessions for verified identities.
• Redis bridge mode with signed sessions and Pub/Sub updates.
• DATABASE bridge mode through shared SQL polling when Redis is unavailable.
• MEMORY mode for isolated proxy-only tests.
• HMAC-signed bridge payloads with shared secret validation.
• Optional hashed IP values and IP binding.
• Auth, lobby and limbo logical realm messages sent to Bukkit PAL.
• Backend failover handling with fallback/auth redirects.
• Protection against redirect loops after backend kicks.
• Configurable proxy messages.
• Same behavior model across Velocity and BungeeCord.

Bridge modes

• REDIS — recommended for production networks. Provides signed session payloads and Pub/Sub notifications.
• DATABASE — works without Redis when the proxy and Bukkit server share the same remote SQL database. The proxy detects updates by polling.
• MEMORY — local proxy memory only. Useful for tests and proxy-local checks, but it does not sync Bukkit sessions across processes.
• DISABLED — turns the bridge off.

Requirements

• PAL installed on the Bukkit auth/lobby server.
• Velocity or BungeeCord proxy.
• The same bridge.sec.secret on Bukkit and proxy.
• Redis for the recommended bridge mode, or shared remote SQL for DATABASE mode.
• Backend servers protected by firewall rules and proxy forwarding secrets.

Optional integrations:

• FastLogin — premium login-mode decisions.
• Floodgate — Bedrock player detection.

Network login flow

1. Player connects to the proxy.
2. PAL Proxy checks FastLogin, Floodgate or native premium identity support.
3. If a valid signed PAL session exists, the player is allowed to reach the requested backend.
4. If no valid session exists, the player is routed to the auth server.
5. Bukkit PAL authenticates the player and saves a session.
6. In REDIS mode, Bukkit publishes the signed session immediately.
7. In DATABASE mode, the proxy sees the signed session on its next poll.
8. PAL Proxy sends the player to the original destination.

Failover behavior

When a backend kicks or fails, PAL Proxy validates the configured fallback against the current PAL session.

• Valid session: the player can be moved to fallback and stays authenticated.
• Missing or expired session: the player is sent to auth.
• Failed backend: PAL Proxy avoids redirecting back to the same server, preventing loops.

If auth is unavailable, bridge.fail.new-login should stay false unless you intentionally want to allow unauthenticated players during auth outages.

Configuration highlights

Key settings live in the proxy bridge.yml:

• bridge.enabled
• bridge.mode
• bridge.net.auth
• bridge.net.lobby
• bridge.guard.strict
• bridge.guard.required
• bridge.guard.proxy-auto-login
• bridge.fail.fallback
• bridge.sec.require
• bridge.sec.secret
• bridge.redis.uri
• bridge.database.remote

For secure networks, use a long random shared secret, keep signed payload validation enabled and protect backend servers at the network/proxy layer.

Compatibility status

PAL Proxy has explicit support for Velocity and BungeeCord. The current beta has been verified primarily with Velocity, PAL on Bukkit/Purpur, Floodgate/Geyser, SQLite/local staging, and ViaVersion/ViaBackwards. BungeeCord, Redis in a live multi-process setup, remote SQL bridge behavior and some FastLogin flows should be tested on your target network before public release.

Support

When requesting support, include:

• Proxy software and version.
• PAL Proxy version.
• Bukkit PAL version.
• Bridge mode.
• Storage type.
• Auth/lobby/fallback server names.
• Whether FastLogin/Floodgate/Geyser are installed.
• Relevant proxy and Bukkit logs.

Do not use review sections for support; use the configured support channel first.