diff --git a/core/src/main/java/com/github/games647/fastlogin/core/shared/FastLoginCore.java b/core/src/main/java/com/github/games647/fastlogin/core/shared/FastLoginCore.java index 99fd5b99..a5723bf4 100644 --- a/core/src/main/java/com/github/games647/fastlogin/core/shared/FastLoginCore.java +++ b/core/src/main/java/com/github/games647/fastlogin/core/shared/FastLoginCore.java @@ -84,8 +84,7 @@ public class FastLoginCore

> { private final Collection pendingConfirms = new HashSet<>(); private final T plugin; - //private final MojangResolver resolver = new MojangResolver(); - private final MojangResolver resolver = new ProxyAgnosticMojangResolver(); + private MojangResolver resolver; private Configuration config; private SQLStorage storage; @@ -120,6 +119,9 @@ public class FastLoginCore

> { return; } + // Initialize the resolver based on the config parameter + this.resolver = this.config.getBoolean("useProxyAgnosticResolver", false) ? new ProxyAgnosticMojangResolver() : new MojangResolver(); + rateLimiter = createRateLimiter(config.getSection("anti-bot")); Set proxies = config.getStringList("proxies") .stream() diff --git a/core/src/main/resources/config.yml b/core/src/main/resources/config.yml index e3a01799..984f0618 100644 --- a/core/src/main/resources/config.yml +++ b/core/src/main/resources/config.yml @@ -152,6 +152,17 @@ forwardSkin: true # If they still want to invoke the command, they have to invoke /premium again premium-warning: true +# When set to true, enables the use of alternative session resolver which does not send the server IP +# to mojang session servers. This setting might be useful when you are trying to run the server via a +# transparent reverse proxy or some other form of DNAT. As far as security goes, this setting has +# negligible to no security impact. +# +# !!! [WARNING] !!! +# This option is considered highly experimental. While it is highly unlikely this will break your server, +# more tests need to be conducted in order to verify it's effectiveness. Brief tests seemed promising, but +# every environment is different, and so it might not work for you as it did for me. +useProxyAgnosticResolver: false + # If you have autoRegister or nameChangeCheck enabled, you could be rate-limited by Mojang. # The requests of the both options will be only made by FastLogin if the username is unknown to the server # You are allowed to make 600 requests per 10-minutes (60 per minute)