EasyAuth Local Sessions

A Minecraft 1.20.1 Fabric patching (mixin) mod that adds locally stored sessions for automatic authorization in EasyAuth by NikitaCartes mod to provide seamless login without password for offline players.

Features

• Client: Seamless authorization per request by server
• Client: Stores generated authorization token after authenticating with password for the first time
• Client: Fallback to usual behaviour if server does not accept authorization token (e.g. this patch is not installed on server or authorization token is invalid)
• Client: Authorization tokens stored locally are encrypted with a key derived from player UUID and IP address of the server (AES-GCM-256)
• Client: Authorization tokens are further protected by hashing the derived key to protect them from malware on device
• Server: Generated authorization tokens are hashed to mitigate filesystem breach attack

Client-side saved authorization tokens (for servers you join) are stored in config/EasyAuthLocalSessions-client/ directory

Server-side saved authorization tokens (for players joining your server) are stored in EasyAuth/EasyAuthLocalSessions-server

Install

Server:

1. Download this mod to server
2. (optional but HIGHLY RECOMMENDED!) Set session-timeout to -1 in config/EasyAuth/main.conf to disable IP authorization (which is insecure and unneeded with this mod)

Client:

For obvious reasons, don't install this mod to guest computers or type /logout when you're leaving it

1. Download this mod to client
2. Join the server and login with your password for the first and only time
3. From now on, every time you're joining the server (and server prompts to authorize) the mod will silently send authorization token
4. If you want to stop this behaviour, type /logout on the server you want to log out from
5. If you believe your authorization token was compromised, changing password revokes all authorization tokens on the server for your account

Important caveats:

• Locally stored authorization tokens are tied to the exact server address (see issue #1) and player UUID (derived from name for offline players)
• If a server changes IP address, port, domain, you'll have to authorize again. Even if you join example.org:25565 instead of example.org it will be considered a separate server with separate tokens ( see issue #1). And vice versa, if someone hosts a server under the same domain or IP address, the mod will send the authorization token to it, which can then be used in replay attacks. See issue #2