AuthMePlus | /GOD PROTECTED AUTH SYSTEM v1.0.3.1-STABLEVERSION

• Fixed a bug where sessions could expire while the player was still online, forcing random “please /login” messages mid-game.
• Session timeout is now only checked on rejoin, so as long as a player stays connected, they stay authenticated.
• No configuration changes are required for this fix.

AuthmePlus v0.0.2-BETA – Security & Captcha Overhaul​

Added

• Added chat-based CAPTCHA before any /login or /register:
  • Players must solve a code shown in title + chat before they can use login/register.
  • New captcha.yml config (length, charset, timeout, attempts, messages).
• Added CAPTCHA visuals:
  • captcha title template with %captcha% placeholder.
  • Optional captcha-wait actionbar hint while the code is active.
  • BossBar state for captcha wait (re-uses login/register pipeline).
• Added AntiBot system (anti-bot.yml):
  • Global join-rate limit (joins per 10s).
  • Per-IP join limit with temporary block.
  • “Suspicious spike” mode that forces CAPTCHA instead of just kicking.
  • IP-verify layer (first-join & IP-change kick with SQL/YAML storage).
• Added multi-auth mode switch in config.yml:
  • AUTO / SPIGOT / BUNGEE modes for single-server and proxy networks.
• Added login effects module:
  • Optional BLINDNESS / SLOW / JUMP etc. while not logged in.
• Added inventory / world lock until login:
  • Blocked: inventory open/move, drop/pickup, block break/place, damage in/out.
• Added email-aware registration & recovery hooks:
  • /register can require email if recovery.yml enables it.
  • Messages for recovery request and reset flow.
• Added IP lock system:
  • IP-bound accounts with clear messages for allowed/denied IP and admin actions.
• Added brute-force protection:
  • Max failed attempts → cooldown with formatted “X seconds left” message.

Changed

• Login/register hint system reworked:
  • Titles, BossBars, ActionBars and particles now respect session state correctly.
  • /login + /register are blocked while CAPTCHA is active, with clear messages.
• All CAPTCHA-related messages now use the global prefix from messages.yml.
• Visual hints (titles/bossbars/actionbars) now stop as soon as the player is authenticated and restart correctly on next join if needed.
• BossBar handling:
  • Login/register bossbars can persist “until login” if configured.
  • Success bar now always clears old login/register bars.

Fixed

• Fixed async kick error on wrong CAPTCHA:
  • Kicking is now scheduled on the main thread, no more Asynchronous player kick exceptions.
• Fixed CAPTCHA code parsing:
  • Plugin now correctly compares the raw chat message with the expected code (no more extra name/prefix trash in the value).
• Fixed CAPTCHA not re-appearing after relog:
  • Active state is cleared on quit and recreated on join when needed.
• Fixed register/login messages firing in the wrong order:
  • Player now sees CAPTCHA first, then login/register prompts only after solving it.
• Fixed BossBar not showing / disappearing too early in some flows.
• Fixed prefix-less messages:
  • All user-facing messages in the captcha/login/register/security flow now go through MessageService and include the configured prefix.