Session Management

Session Management in NexAuth provides a mechanism for players to automatically log in if they reconnect to the server within a specified time frame. This feature enhances user experience by reducing the need for repeated password entry for players who quickly rejoin, provided they connect from the same IP address.

The core of this system revolves around tracking the player's last successful authentication time. When a player joins, the system checks this timestamp against the configured session timeout. If the session is still valid, the player bypasses the standard authentication process and is immediately authorized.

Configuration

Session management is controlled by a single configuration key in the config.conf file.

Sources: Plugin/src/main/java/xyz/xreatlabs/nexauth/common/config/ConfigurationKeys.java:298-302

Example Configuration Snippet

public static final ConfigurationKey<Long> SESSION_TIMEOUT = new ConfigurationKey<>(
        "session-timeout",
        0L,
        "Defines a time in seconds after a player's session expires. Default value is one week (604800 seconds). Set to zero or less to disable sessions.",
        ConfigurateHelper::getLong
);

Sources: Plugin/src/main/java/xyz/xreatlabs/nexauth/common/config/ConfigurationKeys.java:298-304

Session Validation

The session validation logic is executed when a player logs into the server. The process is handled within the AuthenticAuthorizationProvider.

The following diagram illustrates the sequence of events during player login to validate a session.

Validation Logic Flow

The logic follows a clear path of checks to determine if a session is valid.

Key steps in the validation process:

1. Retrieve the session-timeout value from the configuration. If it's disabled (<= 0), the check is skipped.
2. Fetch the user's data from the database, which includes their last authentication timestamp and IP address.
3. Verify that the player's current IP address matches the one stored from their last session.
4. Calculate the difference in seconds between the current time and the lastAuthentication timestamp.
5. If the difference is within the configured session-timeout, the player is automatically authorized. Otherwise, they must proceed with the standard authentication flow.

Data Storage

Session-related information is stored as part of the User object in the database. The two crucial fields for this feature are lastAuthentication and ip.

The diagram below shows the relevant fields within the user data structure.

User Data Fields

• lastAuthentication: A java.sql.Timestamp that is updated every time a player successfully authenticates (e.g., via password, 2FA, or a new session). This is the primary field for calculating session expiry.
  Sources: Plugin/src/main/java/xyz/xreatlabs/nexauth/common/database/AuthenticUser.java:31-37, API/src/main/java/xyz/xreatlabs/nexauth/api/database/User.java:55-56
• ip: The player's last known IP address, stored as a String. It is used as a security measure to ensure that a session can only be resumed from the same IP address.
  Sources: Plugin/src/main/java/xyz/xreatlabs/nexauth/common/database/AuthenticUser.java:106-111

The nexauth user info <name> command can be used by staff to view a user's last_authenticated time.

Sources: Plugin/src/main/java/xyz/xreatlabs/nexauth/common/command/commands/staff/NexAuthCommand.java:181-192

Session Lifecycle

A session begins when a player successfully authenticates. The lastAuthentication timestamp and their current ip are recorded in the database.

When the same player later disconnects and reconnects:

• If within the timeout period and from the same IP: The session is considered valid. The player is auto-logged in, and the lastAuthentication timestamp is updated to the current time, effectively renewing the session.
• If the timeout has expired or the IP is different: The session is invalid. The player must re-authenticate using their credentials. Upon successful authentication, a new session is created by updating the lastAuthentication timestamp and ip.

This system ensures a balance between convenience for legitimate players and security against unauthorized session hijacking from different locations.

Sources: Plugin/src/main/java/xyz/xreatlabs/nexauth/common/authorization/AuthenticAuthorizationProvider.java:101-118, Plugin/src/main/java/xyz/xreatlabs/nexauth/common/AuthenticNexAuth.java:1022-1024