Перейти к содержимому
Mineforgian

Better WebConsole

Secure real-time web console for Minecraft servers

Загрузки
445
Подписчики
8
Обновлён
23 июня 2026 г.
Лицензия
MIT

Опубликован 1 апреля 2026 г.

Исходный кодСообщить об ошибке

Better-WebConsole

Secure browser console and admin dashboard for Paper/Purpur/Spigot 1.21.x servers.

Features

Web Console

  • Embedded Jetty web server with one built-in web UI.
  • Live console log streaming over WebSocket with buffered history for new sessions.
  • Console command execution through the server command map, including commands from plugins such as CMI.
  • Command history, filtering, log export and clear action in the browser.
  • Configurable web aliases through !alias, including chained aliases with &&.
  • Audit log for auth events, command execution, player actions and log exports.

Dashboard

  • Desktop-focused two-column dashboard layout for server administration.
  • Server health: TPS, JVM heap, online players, worlds, loaded chunks, entities and session errors.
  • Machine health: host CPU load, Java process CPU load, physical RAM, server disk usage and JVM thread counts.
  • Performance history charts for TPS, JVM RAM, online players and host CPU.
  • Machine details: CPU model, cores/threads, memory, disk mount, OS, Java runtime, PID and JVM uptime.
  • Analytics blocks for log levels, per-world chunks/entities and recent activity.
  • Player list with quick kick/ban actions.

Security

  • Web users stored in plugins/Better-WebConsole/users.dat with BCrypt hashes.
  • HttpOnly + SameSite session cookies, optional Secure cookies for HTTPS reverse proxies.
  • CSRF protection for login.
  • IP whitelist with CIDR support.
  • Login lockout and command rate limit.
  • Optional command block list for dangerous console commands.

First Setup

  1. Put the JAR into the server plugins/ folder.
  2. Start the server once to generate plugins/Better-WebConsole/config.yml.
  3. Create a web user:
/bwc adduser admin YourStrongPassword123
  1. Open:
http://your-server-ip:4242

Production recommendation: bind to 127.0.0.1 and expose the panel through Nginx, Caddy, a VPN or a tunnel with HTTPS.

Commands

Main command aliases: /betterwebconsole, /bwc, /webconsole, /bwconsole, /betterconsole.

Permission: betterwebconsole.admin (default: op).

Command Description
/bwc status Show web server, user, session and config status
/bwc reload Reload config values that do not require web server restart
/bwc adduser <user> <password> Add a web user
/bwc removeuser <user> Remove a web user and invalidate sessions
/bwc listusers List web users
/bwc setpassword <user> <new-password> Change password and invalidate sessions
/bwc logoutall <user> Invalidate active sessions for a user

Extra command aliases: useradd, createuser, deluser, deleteuser, users, passwd, password, killsessions.

Configuration

The default config is intentionally small and only contains implemented behavior.

web:
  port: 4242
  bind-address: "0.0.0.0"
  log-buffer-size: 1000

security:
  session-timeout-minutes: 60
  max-login-attempts: 5
  lockout-duration-minutes: 15
  command-rate-limit-per-minute: 30
  ip-whitelist: []
  secure-cookies: false

logging:
  log-commands: true
  log-auth: true
  audit-log: true

system-stats:
  # Adds host CPU, machine RAM, disk, OS and JVM details to the dashboard.
  enabled: true

  # OS-level polling interval. Keep this above 2 seconds for production servers.
  update-interval-seconds: 5

  # Reports disk usage for the Minecraft server folder.
  show-disk: true

commands:
  blocked: []
  aliases:
    tps: "tps"
    list: "list"
    save: "save-all"
    day: "time set day"
    night: "time set night"
    clear-weather: "weather clear"

system-stats can be disabled if the host does not allow OS-level metrics or if you only need Minecraft/JVM data.

Use commands.blocked to prevent risky commands from web access, for example:

commands:
  blocked: ["stop", "restart", "op", "deop"]

Use an alias by typing !name in the web console. Aliases can chain up to 10 commands with &&.

/bwc reload updates aliases, logging, system stats settings and command block rules. Restart the Minecraft server after changing web.port, web.bind-address, security.ip-whitelist, session timeout or rate-limit settings.

Security Notes

  • Do not expose 0.0.0.0:4242 directly to the internet unless firewall/IP whitelist/VPN rules are in place.
  • Set secure-cookies: true only when users access the panel through HTTPS.
  • Block or avoid destructive commands such as stop, restart, op, deop, ban-ip and whitelist.
  • Keep aliases short and auditable.
  • Keep commands.blocked empty only when every web user is trusted as a full console administrator.
  • Treat machine metrics as operational data: expose the panel only to trusted administrators.

Ченджлог

2.4.9Релиз26.1, 26.1.1, 26.1.2 · 23 июня 2026 г.

Changed

  • Version bump 2.4.9.
  • Added grouped Paper build artifacts for Minecraft/Paper 1.21 - 1.21.11 and 26.1 - 26.1.2.
  • Shortened generated jar names to bwc-<version>-paper-1.21.X.jar and bwc-<version>-paper-26.X.jar.
  • Ignored module target directories.
  • Updated README build output and system-stats.history / player-activity configuration docs.
  • Rendered Minecraft legacy, hex and MiniMessage-style player name colors in the Players tab.

Added

  • Added /api/players/offline with pagination, search and configurable page limits for offline player lists.
  • Added live one-point stats history samples to stats payloads so charts keep moving between persisted history loads.

Performance

  • Cached heavy player activity, known-player and offline-player payloads instead of rebuilding them every stats tick.
  • Reduced repeated LuckPerms/offline-player work during dashboard stats broadcasts.
  • Reused the server stats history append writer and flushed it in small batches instead of opening the file for every stat point.
  • Kept live TPS/RAM/player/CPU chart samples updating from the stats stream every second while longer chart ranges load from persisted history.
  • Buffered player activity history writes with configurable batch flushing.
  • Moved offline player lists to a paged /api/players/offline endpoint instead of including them in every stats payload.
  • Added configurable cache and flush intervals for stats history and player activity payloads.
  • Split Chart.js into a lazy-loaded frontend chunk so the initial web UI bundle is smaller.

Full Changelog: https://github.com/AREKKUZZERA/better-web-console/compare/2.4.8...2.4.9

2.4.9Релиз1.21.9, 1.21.10, 1.21.11 · 23 июня 2026 г.

Changed

  • Version bump 2.4.9.
  • Added grouped Paper build artifacts for Minecraft/Paper 1.21 - 1.21.11 and 26.1 - 26.1.2.
  • Shortened generated jar names to bwc-<version>-paper-1.21.X.jar and bwc-<version>-paper-26.X.jar.
  • Ignored module target directories.
  • Updated README build output and system-stats.history / player-activity configuration docs.
  • Rendered Minecraft legacy, hex and MiniMessage-style player name colors in the Players tab.

Added

  • Added /api/players/offline with pagination, search and configurable page limits for offline player lists.
  • Added live one-point stats history samples to stats payloads so charts keep moving between persisted history loads.

Performance

  • Cached heavy player activity, known-player and offline-player payloads instead of rebuilding them every stats tick.
  • Reduced repeated LuckPerms/offline-player work during dashboard stats broadcasts.
  • Reused the server stats history append writer and flushed it in small batches instead of opening the file for every stat point.
  • Kept live TPS/RAM/player/CPU chart samples updating from the stats stream every second while longer chart ranges load from persisted history.
  • Buffered player activity history writes with configurable batch flushing.
  • Moved offline player lists to a paged /api/players/offline endpoint instead of including them in every stats payload.
  • Added configurable cache and flush intervals for stats history and player activity payloads.
  • Split Chart.js into a lazy-loaded frontend chunk so the initial web UI bundle is smaller.

Full Changelog: https://github.com/AREKKUZZERA/better-web-console/compare/2.4.8...2.4.9

2.4.8Релиз26.1, 26.1.1, 26.1.2 · 22 июня 2026 г.

Added

  • Added a fallback /api/stats polling path in the web UI so dashboard data can recover when WebSocket stats are delayed or unavailable.
  • Added tests for absolute session lifetime expiry behavior.
  • Persistent TPS/RAM/CPU/player history storage in server-stats-history.tsv.
  • New authenticated endpoint: GET /api/stats/history.
  • Dashboard range selector for 1h, 6h, 24h, and all.
  • Offline player roster, offline profile lookup, and last-seen display.
  • LuckPerms rank/prefix display via soft dependency.
  • Config options for stats history retention, API max points, and write interval.

Changed

  • Added an absolute web session lifetime limit in addition to the idle timeout.
  • Added security.session-max-lifetime-minutes to config.yml and README examples.
  • Set the session cookie Max-Age from the absolute session lifetime so browser cookies and server-side sliding sessions stay consistent.
  • Matched unknown-user dummy bcrypt verification cost to real password hashes.
  • Updated /bwc reload messaging and docs to mention that session max lifetime changes require a server restart.
  • Dashboard charts now render persisted/downsampled history.
  • Player models support online/offline state, rank metadata, and activity counters.
  • Paper 26.1 grouped artifact renamed from 26.1.X to 26.X.
  • Project version bumped to 2.4.8.

Fixed

  • Restored normal login form submit behavior for browser autofill, password managers and automation.
  • Cleared the password field after a successful web login.
  • Warned server owners when the web panel listens on all interfaces without secure cookies or an IP whitelist.
  • Ensured loaded persisted sessions are rejected when they exceed the absolute lifetime, even if their idle timeout has not expired.

Full Changelog: https://github.com/AREKKUZZERA/better-web-console/compare/2.4.6...2.4.8

2.4.8Релиз1.21.9, 1.21.10, 1.21.11 · 22 июня 2026 г.

Added

  • Added a fallback /api/stats polling path in the web UI so dashboard data can recover when WebSocket stats are delayed or unavailable.
  • Added tests for absolute session lifetime expiry behavior.
  • Persistent TPS/RAM/CPU/player history storage in server-stats-history.tsv.
  • New authenticated endpoint: GET /api/stats/history.
  • Dashboard range selector for 1h, 6h, 24h, and all.
  • Offline player roster, offline profile lookup, and last-seen display.
  • LuckPerms rank/prefix display via soft dependency.
  • Config options for stats history retention, API max points, and write interval.

Changed

  • Added an absolute web session lifetime limit in addition to the idle timeout.
  • Added security.session-max-lifetime-minutes to config.yml and README examples.
  • Set the session cookie Max-Age from the absolute session lifetime so browser cookies and server-side sliding sessions stay consistent.
  • Matched unknown-user dummy bcrypt verification cost to real password hashes.
  • Updated /bwc reload messaging and docs to mention that session max lifetime changes require a server restart.
  • Dashboard charts now render persisted/downsampled history.
  • Player models support online/offline state, rank metadata, and activity counters.
  • Paper 26.1 grouped artifact renamed from 26.1.X to 26.X.
  • Project version bumped to 2.4.8.

Fixed

  • Restored normal login form submit behavior for browser autofill, password managers and automation.
  • Cleared the password field after a successful web login.
  • Warned server owners when the web panel listens on all interfaces without secure cookies or an IP whitelist.
  • Ensured loaded persisted sessions are rejected when they exceed the absolute lifetime, even if their idle timeout has not expired.

Full Changelog: https://github.com/AREKKUZZERA/better-web-console/compare/2.4.6...2.4.8

2.4.7Релиз26.1, 26.1.1, 26.1.2 · 27 мая 2026 г.

Added

  • Added Spanish (es) localization to the web UI language selector.
  • Added missing localized labels for sessions, audit, config, diagnostics and player profile fields across supported languages.

Changed

  • Replaced OSHI-based system metrics with Java runtime and OS MXBean metrics to reduce shaded dependencies and runtime native-library issues.
  • Added stable name attributes to login, console, player, audit, config and modal form controls for better browser autofill and automation compatibility.
  • Localized remaining hardcoded player activity and profile labels.

Fixed

  • Collected an initial stats snapshot when the plugin starts so the dashboard has data sooner after startup.
  • Loaded existing logs/latest.log lines into the web console backlog before live log capture starts.
2.4.7Релиз1.21.9, 1.21.10, 1.21.11 · 27 мая 2026 г.

Added

  • Added Spanish (es) localization to the web UI language selector.
  • Added missing localized labels for sessions, audit, config, diagnostics and player profile fields across supported languages.

Changed

  • Replaced OSHI-based system metrics with Java runtime and OS MXBean metrics to reduce shaded dependencies and runtime native-library issues.
  • Added stable name attributes to login, console, player, audit, config and modal form controls for better browser autofill and automation compatibility.
  • Localized remaining hardcoded player activity and profile labels.

Fixed

  • Collected an initial stats snapshot when the plugin starts so the dashboard has data sooner after startup.
  • Loaded existing logs/latest.log lines into the web console backlog before live log capture starts.
2.4.6Релиз26.1, 26.1.1, 26.1.2 · 27 мая 2026 г.

Added

  • Added searchable audit log table with filters by action, user, IP and text query.
  • Added audit export in JSON and CSV formats.
  • Added web config editor for aliases, blocked commands, logging and system stats options.
  • Added compatibility diagnostics for plugin version, Java, server version and supported Paper/Purpur lines.
  • Added recent error grouping for console ERROR/SEVERE/exception lines.
  • Added player profile drawer with UUID, gamemode, health, food, level, location and recent activity.

Changed

  • Improved dashboard with compatibility and error summary blocks.
  • Improved player activity history grouping, expand/collapse behavior and mobile layout.
  • Improved sessions and audit tables on small screens.
  • Refactored the frontend from legacy bundled code into React components and shared webconsole modules.
2.4.6Релиз1.21.9, 1.21.10, 1.21.11 · 27 мая 2026 г.

Added

  • Added searchable audit log table with filters by action, user, IP and text query.
  • Added audit export in JSON and CSV formats.
  • Added web config editor for aliases, blocked commands, logging and system stats options.
  • Added compatibility diagnostics for plugin version, Java, server version and supported Paper/Purpur lines.
  • Added recent error grouping for console ERROR/SEVERE/exception lines.
  • Added player profile drawer with UUID, gamemode, health, food, level, location and recent activity.

Changed

  • Improved dashboard with compatibility and error summary blocks.
  • Improved player activity history grouping, expand/collapse behavior and mobile layout.
  • Improved sessions and audit tables on small screens.
  • Refactored the frontend from legacy bundled code into React components and shared webconsole modules.

Комментарии

Загружаем…