FastLogin: automatic login for paid accounts

What FastLogin is

FastLogin solves one of the biggest annoyances on offline-mode servers: manual logins. On these servers every player has to type /register password on their first visit and /login password on every visit after that. That gets tedious, especially for players who own a paid Mojang account and naturally expect to be verified automatically.

FastLogin automates the process. It checks whether the player's name exists in Mojang's database and whether the client is genuine. If so, it skips the login prompt and lets the player in right away. Accounts that can't be verified still have to use /login, but players with a paid account get the same smooth experience as on an online-mode server.

You can get the plugin from SpigotMC. The source code is on GitHub.

How auto-login works

FastLogin's verification runs in a few steps:

1. The player connects to the server and gives their username
2. FastLogin checks the Mojang API to see whether the username belongs to a paid account
3. If it does, the server temporarily switches to online-mode for that specific connection
4. The player's Minecraft client automatically goes through Mojang's session verification
5. FastLogin tells the login plugin (AuthMe) to skip the /login screen
6. The player joins the server without typing a password

The whole process takes a fraction of a second and the player doesn't see it. For a player with a paid account, an offline-mode server behaves just like an online-mode one.

Installation and configuration

FastLogin requires a login plugin (AuthMe, LoginSecurity or nLogin). Installation:

1. Make sure the server has online-mode: false in server.properties
2. Install a login plugin (for example AuthMe)
3. Put FastLogin in the plugins/ folder
4. Restart the server

Key settings in plugins/FastLogin/config.yml:

# Automatic detection of paid-account players
auto-register: true

# Enforce paid login for names that exist at Mojang
name-change-check: true

# Storage (MySQL for networks, SQLite for a single server)
storage:
  type: sqlite

On BungeeCord/Velocity networks, install FastLogin on the proxy. On the backend servers AuthMe/nLogin is enough: FastLogin on the proxy passes along the paid-account status.

AuthMe integration

FastLogin most often works together with AuthMe, the most popular login plugin. The integration is automatic: FastLogin detects AuthMe and talks to it through its API.

How different kinds of players are handled:

• Player with a paid account - FastLogin verifies the Mojang account and AuthMe skips the login. The player joins immediately
• Player whose account can't be verified - FastLogin can't verify the account, so AuthMe requires /register and /login as usual
• Player with a paid account whose username is already taken by an unverified player - FastLogin detects the conflict and requires additional verification

This setup is called "semi-premium": the server handles players with verified paid accounts and players with unverified accounts differently, depending on account status.

Security

FastLogin adds an extra layer of security on offline-mode servers:

• Protection of paid usernames - if a username belongs to a Mojang account, only the owner of that account can play under it. This prevents impersonating well-known players
• Name change tracking - Mojang lets players change their username. FastLogin tracks these changes and updates the player's data
• UUID matching - FastLogin assigns the correct paid-account UUID to players, which prevents data loss after a name change

Without FastLogin, an offline-mode server is open to an attack where someone impersonates a player with a paid account (for example an admin). The attacker creates an account with the admin's username and logs in with the admin's permissions. FastLogin closes off this attack vector.

Tips

• MySQL on networks - on a multi-server network, use MySQL instead of SQLite so that paid-account status is shared between the proxy and the backend servers
• Mojang API timeout - if the Mojang API doesn't respond (an outage), FastLogin treats the player as unverified. Set a reasonable timeout (5 seconds)
• Works with SkinsRestorer - the two plugins work together well. FastLogin handles the login, SkinsRestorer restores the skin
• Floodgate - if you use Floodgate for Bedrock players, FastLogin automatically recognizes their prefix (for example ".") and doesn't try to verify them as Java paid accounts

Related: SkinsRestorer, Velocity, BungeeCord.