Authentication / Proxy bridgePrivate source
AuthMePremium
Proxy authentication where trust boundaries are explicit.
An authentication bridge for AuthMe networks, with a companion plugin path and an optional Velocity-native AuthMe 6 session path.
Current build 2.7.2. Documentation in the repository lags the POM, so this page uses the POM version.
Checked version 2.7.2
Evidence checked 2026-10-30
The problem
Premium and cracked players enter through different identity paths. A proxy bridge that treats a matching token as proof of a UUID, or silently falls back when configuration is wrong, creates an account-takeover surface.
What I built
- Built two explicit session bridges: a companion plugin-message path and a Velocity-native AuthMe 6 path.
- Made the native bridge fail closed on blank secrets, empty source/target lists or invalid retry settings.
- Separated proxy trust files from the bridge token instead of conflating them.
- Added YAML, MySQL and in-memory profile storage with TTL caches and UUID migration state.
Architecture and trade-offs
Two bridges, not a fallback chain
Mode A uses the authmp plugin-message channel with the backend companion. Mode B uses AuthMe 6 native messages and is Velocity-only. Each can be configured and reasoned about independently.
Fail closed on bad configuration
A blank secret, empty server lists or invalid retry values disable the native bridge with a warning. The bridge does not log the secret and does not continue with partial trust.
Proxy trust is separate
Backend proxy approval is tracked in pending and allowed proxy files. A valid bridge token does not automatically approve a backend UUID.