Security Configuration

Relevant source files

The following files were used as context for generating this wiki page:

• Plugin/src/main/java/xyz/xreatlabs/nexauth/common/crypto/Argon2IDCryptoProvider.java
• Plugin/src/main/java/xyz/xreatlabs/nexauth/common/crypto/BCrypt2ACryptoProvider.java
• Plugin/src/main/resources/forbidden-passwords-template.txt
• Plugin/src/main/java/xyz/xreatlabs/nexauth/common/config/ConfigurationKeys.java
• Plugin/src/main/java/xyz/xreatlabs/nexauth/common/AuthenticNexAuth.java
• Plugin/src/main/java/xyz/xreatlabs/nexauth/paper/protocol/EncryptionUtil.java
• Plugin/src/main/java/xyz/xreatlabs/nexauth/common/mail/AuthenticEMailHandler.java
• Plugin/src/main/java/xyz/xreatlabs/nexauth/common/command/Command.java

NexAuth provides a robust and configurable security framework to protect player accounts and the server. This includes modern password hashing algorithms, protection against brute-force attacks, comprehensive password policies, two-factor authentication (2FA), and secure password recovery mechanisms. Administrators can fine-tune these security aspects through the config.conf file to match their specific security requirements.

The core of the security system is managed within the AuthenticNexAuth class, which orchestrates the various security components like crypto providers, authentication listeners, and configuration loading. Security settings are defined as static keys in ConfigurationKeys.java and are applied during the plugin's startup and runtime operations.

Password Hashing

NexAuth supports multiple password hashing algorithms to ensure passwords are stored securely. The desired algorithm can be set in the configuration.

Sources: Plugin/src/main/java/xyz/xreatlabs/nexauth/common/config/ConfigurationKeys.java:80-89, Plugin/src/main/java/xyz/xreatlabs/nexauth/common/AuthenticNexAuth.java:278-284

Supported Hashing Algorithms

The plugin registers several CryptoProvider implementations, allowing for flexibility and backward compatibility.

Algorithm	Identifier	Recommended	Description
BCrypt (2A)	BCrypt-2A	Yes	A modern, adaptive hashing function that is widely considered secure. This is the default provider.
Argon2id	Argon-2ID	Yes	A state-of-the-art, memory-hard hashing algorithm. It provides higher security than BCrypt but may increase server load.
SHA-512	SHA-512	No	A standard cryptographic hash function. Not recommended for new passwords as it's not adaptive. Included for migration/compatibility.
SHA-256	SHA-256	No	Similar to SHA-512 but with a smaller hash size. Not recommended for new passwords. Included for migration/compatibility.

Sources: Plugin/src/main/java/xyz/xreatlabs/nexauth/common/config/ConfigurationKeys.java:80-89, Plugin/src/main/java/xyz/xreatlabs/nexauth/common/crypto/BCrypt2ACryptoProvider.java, Plugin/src/main/java/xyz/xreatlabs/nexauth/common/crypto/Argon2IDCryptoProvider.java

The following diagram shows how different crypto providers are registered during plugin initialization.

Configuration

The default hashing algorithm is configured using the default-crypto-provider key.

// Plugin/src/main/java/xyz/xreatlabs/nexauth/common/config/ConfigurationKeys.java:80-89
public static final ConfigurationKey<String> DEFAULT_CRYPTO_PROVIDER = new ConfigurationKey<>(
        "default-crypto-provider",
        "BCrypt-2A",
        """
                The default crypto provider. This is used for hashing passwords. Available Providers:
                SHA-256 - Older, not recommended. Kept for compatibility reasons.
                SHA-512 - More safer than SHA-256, but still not recommended. Kept for compatibility reasons.
                BCrypt-2A - Newer, more safe, recommended
                Argon-2ID - Newest, should be safer than BCrypt-2A, however, it can slow down the server.
                """,
        ConfigurateHelper::getString
);

Authentication Policies

NexAuth implements several policies to prevent unauthorized access and mitigate common attacks.

Login Attempt Limiting

To protect against brute-force attacks, NexAuth can limit the number of failed login attempts before kicking a player.

Configuration Key	Type	Default	Description
max-login-attempts	Integer	-1	Kicks the player if the number of incorrect password attempts is met or exceeded. A value of -1 disables this feature.
milliseconds-to-refresh-login-attempts	Integer	10000	The time in milliseconds a player must wait for their login attempt counter to reset. The counter also resets on every rejoin.

This logic is handled by the LoginTryListener class, which is initialized in AuthenticNexAuth.

Sources: Plugin/src/main/java/xyz/xreatlabs/nexauth/common/config/ConfigurationKeys.java:112-125, Plugin/src/main/java/xyz/xreatlabs/nexauth/common/AuthenticNexAuth.java:318

Authorization Timeout

Players are given a limited time to log in or register before being kicked from the server.

Configuration Key	Type	Default	Description
seconds-to-authorize	Integer	-1	The time limit in seconds for a player to complete authentication. A negative value disables the timeout.

Sources: Plugin/src/main/java/xyz/xreatlabs/nexauth/common/config/ConfigurationKeys.java:180-184

IP-Based Account Limit

You can limit the number of accounts that can be registered from a single IP address. This is generally not recommended due to shared IP addresses (NAT).

Configuration Key	Type	Default	Description
ip-limit	Integer	-1	The maximum number of accounts that can be registered from the same IP. Set to zero or less to disable.

Sources: Plugin/src/main/java/xyz/xreatlabs/nexauth/common/config/ConfigurationKeys.java:155-161

Password Policies

To enforce strong passwords, NexAuth provides policies for minimum length and a blocklist of common passwords.

Minimum Password Length

You can set a minimum character length for new passwords.

Configuration Key	Type	Default	Description
minimum-password-length	Integer	-1	The minimum required length for a password. Set to a negative value to disable.

Sources: Plugin/src/main/java/xyz/xreatlabs/nexauth/common/config/ConfigurationKeys.java:275-279

Forbidden Passwords

NexAuth uses a list of forbidden passwords to prevent users from choosing weak or common credentials. This list is loaded from forbidden-passwords.txt upon startup. If the file doesn't exist, it's downloaded from the NexAuth GitHub repository.

The validation flow is as follows:

This diagram illustrates the password validation process.

Sources: Plugin/src/main/java/xyz/xreatlabs/nexauth/common/AuthenticNexAuth.java:214-225, 608-632, Plugin/src/main/java/xyz/xreatlabs/nexauth/common/command/Command.java:100-101, Plugin/src/main/resources/forbidden-passwords-template.txt

Two-Factor Authentication (2FA/TOTP)

NexAuth supports Time-based One-Time Passwords (TOTP) for 2FA, compatible with apps like Google Authenticator and Authy.

2FA Configuration

Configuration Key	Type	Default	Description
totp.enabled	Boolean	true	Enables or disables the TOTP feature.
totp.label	String	NexAuth Network	The label displayed in the authenticator app. Should be set to the server/network name.
totp.delay	Integer	1000	Delay in milliseconds before the QR code map is given to the player.

Sources: Plugin/src/main/java/xyz/xreatlabs/nexauth/common/config/ConfigurationKeys.java:250-270, 314-318

Email-Based Password Recovery

If enabled, players can set a recovery email address to reset their password if they forget it.

Email Configuration

The email feature requires configuring an SMTP server.

Configuration Key	Type	Default	Description
mail.enabled	Boolean	false	Enables or disables the email recovery feature.
mail.host	String	smtp.gmail.com	The SMTP server host.
mail.port	Integer	587	The SMTP server port.
mail.username	String	username	The username for SMTP authentication.
mail.password	String	password	The password for SMTP authentication.
mail.sender	String	NexAuth Network	The sender name displayed in the email.
mail.email	String	email@something.com	The "From" email address.

Sources: Plugin/src/main/java/xyz/xreatlabs/nexauth/common/config/ConfigurationKeys.java:319-354

Password Reset Flow

The following sequence diagram shows the process of a user resetting their password via email.

Connection & Session Security

For Paper servers, NexAuth includes security measures related to the Minecraft session verification process, primarily for premium players.

The EncryptionUtil class handles cryptographic operations related to player authentication with Mojang's session servers. This includes:

• Generating RSA key pairs for the server.
• Verifying client public keys against Mojang's public key.
• Decrypting shared secrets.
• Verifying nonces to prevent replay attacks.

Sources: Plugin/src/main/java/xyz/xreatlabs/nexauth/paper/protocol/EncryptionUtil.java

Mojang Session Key Verification

This flow ensures that a connecting premium player's public key is valid and signed by Mojang.

This diagram shows the high-level verification of a client's public key. The actual implementation in EncryptionUtil.verifyClientKey performs this check locally using Mojang's loaded public key.

Sources: Plugin/src/main/java/xyz/xreatlabs/nexauth/paper/protocol/EncryptionUtil.java:94-104, 131-139