> For the complete documentation index, see [llms.txt](https://impoo.gitbook.io/authenticationsystem/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://impoo.gitbook.io/authenticationsystem/security.md).

# Security

AuthSystem includes several layers of security to protect your server from unauthorized access and abuse.

## Brute-force protection

To prevent password-guessing attacks, AuthSystem tracks failed authentication attempts:

| Limit       | Scope      | Action                     |
| ----------- | ---------- | -------------------------- |
| 5 attempts  | Per player | Kick or ban (configurable) |
| 10 attempts | Per IP     | Kick or ban (configurable) |

When a player exceeds the limit, the action defined in `auth.too-many-attempts` is applied:

* `KICK` — The player is kicked from the server
* `BAN` — The player is banned for `auth.ban-time` seconds (default: 600 = 10 minutes)

## Authentication timeout

Unauthenticated players have a limited time to register or log in:

* **Default timeout:** 60 seconds (`auth.timeout-seconds`)
* **Action on timeout:** The player is kicked from the server

This prevents unauthenticated players from idling on your server indefinitely.

## Movement and chat restrictions

While unauthenticated, players are restricted:

* **Chat:** Unauthenticated players cannot send chat messages (handled by `PlayerChatListener`)
* **Commands:** Unauthenticated players can only run authentication commands (`/register`, `/login`, `/changepassword`, `/premium`, `/auth ...`) (handled by `PlayerCommandListener`)
* **Movement:** Server owners can configure additional movement restrictions if needed

These restrictions are enforced by the `PlayerCommandListener` and `PlayerChatListener` event listeners.

## IP tracking

Each player's last IP address is recorded in the `auth_players` table (`last_ip` column). Staff can check a player's IP using:

```
/auth checkip <player>
```

This is useful for identifying alternate accounts and investigating suspicious activity.

## Premium verification

Premium players are verified through Mojang's authentication system. They must confirm their identity within 10 seconds of joining. This prevents premium account impersonation.

## Password security

* Passwords are hashed with **BCrypt cost 12** before storage
* Passwords are never stored in plain text
* Passwords are never logged or displayed in messages
* The `hashedPassword` column is `VARCHAR(60)` to accommodate BCrypt hashes

***

## Recommended security settings

For a secure production server, consider:

```yaml
auth:
  timeout-seconds: 60
  too-many-attempts: "BAN"
  ban-time: 3600
```

This kicks idle unauthenticated players after 60 seconds and bans brute-force attackers for 1 hour.

***

> :bulb: **Tip**: Combine AuthSystem with a firewall that limits database port (3306) access to your server's IP address only.