SideGate 1.2.2

Release date: 2026-06-10

Added

• Added proxy-mode.enabled for Bukkit backends connected through SideGate for Velocity.
• Added platform-neutral LoginDecision results and evaluateLogin(String) to the public API.
• Added isProxyModeEnabled() to the public API.
• Added configurable Velocity login-decision logging and a Premium-session failure message.

Changed

• Velocity now owns Premium/Guest login decisions while Bukkit proxy mode only applies Guest tags, gamemode, titles, messages, and chat prefix.
• ProtocolLib remains a required dependency for every Bukkit installation, including proxy-mode backends.
• Velocity Premium checks now fail closed on invalid usernames, Mojang API errors, and unexpected responses.
• Velocity Premium checks now use asynchronous HTTP with request deduplication instead of blocking the pre-login handler.
• Velocity now preserves prior Floodgate/authentication-plugin decisions and tracks Guest candidates by connection with expiration.
• Velocity login routing is disabled when online-mode is false or modern player forwarding is not configured.
• Velocity now replaces its generic invalid-session response for Premium-name conflicts with the configured SideGate message.
• allow-all-guests now defaults to true in both editions.

SideGate 1.2.1

Release date: 2026-06-10

Added

• Optional Floodgate and Geyser-Spigot integration. Detected Bedrock players stay on the Floodgate/Geyser authentication path and are not classified or tagged as SideGate guests.
• Soft dependencies for floodgate and Geyser-Spigot; neither plugin is required when Bedrock support is not used.
• Added configurable premium-session-failure.action with KICK_WITH_MESSAGE and FALLBACK_TO_GUEST modes.
• Added a configurable Premium-name conflict message. SideGate compares the login UUID with the official Mojang profile before encryption so cracked launchers that abort on HTTP 401 receive the configured message.
• Added Guest fallback for Premium-name UUID mismatches before encryption, plus same-connection fallback when an invalid encrypted session response is available.

Changed

• Mojang profile lookups now run through ProtocolLib's asynchronous listener path to avoid blocking the packet thread.
• Premium lookup cache entries now expire after 10 minutes and use bounded eviction instead of clearing the entire cache.
• Premium lookup cache entries now retain the official Mojang UUID for early Premium-name conflict detection.
• Mojang API errors, invalid responses, and invalid Java usernames now fail closed by leaving authentication to the server instead of granting guest access.
• Guest connection selection now requires an exact address match or matching login profile name; unsafe cross-connection and port-only fallbacks were removed.
• Removed duplicate [SideGate] text from plugin logger messages because Bukkit already adds the plugin name.
• Compatibility and issue-report startup notices now use INFO; the ProtocolLib dev-build warning is skipped when a development build is already installed.

Fixed

• Fixed Floodgate/Geyser Bedrock players being treated as non-premium guests.
• Fixed a possible guest injection mix-up when multiple login connections were pending.
• Fixed a ProtocolLib TemporaryPlayer warning and stack trace caused by reading an unavailable UUID during early login.

SideGate 1.2.0

Release date: 2026-05-18

Added

• Runtime API service (SideGateApi) exposed through Bukkit ServicesManager for addon/plugin integration.
• Runtime reload support with /sidegate reload to re-read config and rebind listeners.
• Guest handling improvements: guest scoreboard tag, configurable join title/subtitle/messages, and guest-only chat prefix.

Changed

• ProtocolLib is now compileOnly to avoid shading/packaging ProtocolLib into SideGate and prevent classloader conflicts.
• Login-state injection path was adjusted to prefer stable accept states (READY_TO_ACCEPT, fallback ACCEPTED) to reduce non-premium login timeouts.
• Defensive ProtocolLib runtime checks were added to avoid NullPointerException when ProtocolManager is temporarily unavailable.
• Guest login injection now cancels login at START and immediately injects approved guests, with delayed fallback retained for packet-order edge cases.
• Post-auth login pipeline now supports modern GameProfile method signatures (verifyLoginAndFinishConnectionSetup, startClientVerification, finishLoginAndWaitForClient) for newer Paper builds.

Fixed

• Fixed startup failure where ProtocolLibrary.getProtocolManager() could be null and crash plugin enable/disable.
• Fixed guest login flow instability causing repeated guest injection and disconnect timeout behavior in hybrid mode.
• Fixed Invalid session/timeout on Paper 1.21.11 when guest login state advanced incompletely.

Compatibility

• Server: Paper/Spigot/Purpur (Bukkit-compatible)
• Tested: Paper 1.20.1, Spigot 1.20.1, Paper 1.21.11
• Practical compatibility range from implementation behavior: 1.20.1-1.21.11 (with ProtocolLib dev build recommended for 1.21.9+)
• Java: 17+
• Dependency: ProtocolLib 5.x+

Notes

• For hybrid guest mode operation, set enforce-secure-profile=false in server.properties.
• Keep online-mode=true; SideGate handles approved guest flow without globally switching offline mode.
• Added startup warning for Minecraft 1.21.9-26.x to recommend ProtocolLib dev build: https://github.com/dmulloy2/ProtocolLib/releases/tag/dev-build.

SideGate v1.0.1 Changelog

New Features & Enhancements

• Hybrid Auto-Detection System
  • Implemented intelligent Mojang API integration. The plugin now automatically verifies if a connecting username belongs to a paid Minecraft account.
  • Premium Players: Automatically routed through the standard secure login process (preserving skins and UUIDs).
  • Guest/Cracked Players: Automatically redirected to the guest injection protocol without manual intervention.
  • Config Option: auto-detect-premium: true (Enabled by default).
• Premium Override List
  • Added a premium-usernames configuration list.
  • Allows administrators to manually force specific usernames to be treated as Premium, bypassing the API check. This is useful for staff security or in cases of API downtime.
• Performance Optimization
  • Introduced ConcurrentHashMap caching for API results. This minimizes external HTTP requests and prevents login lag during peak traffic.
  • Added a cache cleanup mechanism to prevent memory overflow.

Bug Fixes & Stability

• UUID Handling: Refined the logic for detecting Offline UUIDs (Version 3) to ensure guest restrictions are applied correctly only to non-premium players.
• Packet Injection: Improved the stability of the Login.Client.START packet listener to reduce potential conflicts with other protocol-based plugins.

Configuration Changes

• Added auto-detect-premium (boolean) to toggle the hybrid detection system.
• Added premium-usernames (list) for manual premium overrides.
• Updated default messages to clearer, more professional wording.

Upgrade Instructions: To utilize the new features, please regenerate your config.yml or manually add the new auto-detect-premium and premium-usernames keys to your existing configuration.