Skip to content
BharatMC Docs

BharatMC Login (Enterprise Velocity Auth & Network Security Suite)

Overview

Section titled “Overview”

bharatmc-login is BharatMC’s high-performance authentication, player verification, and network security gateway running natively on the Velocity Proxy. It completely eliminates the need for heavyweight external lobby auth servers by processing all handshakes, password validations, cracked/premium resolutions, and IP checks inside an In-Process Netty Virtual Auth Architecture.

                         Player Connection (Bedrock / Java 1.16 - 1.21.x)
                                                │
                                                ▼
                                   [ Velocity Proxy Gateway ]
                                                │
                 ┌──────────────────────────────┴──────────────────────────────┐
                 ▼                                                             ▼
   [ Anti-VPN & Threat Engine ]                                  [ Redis Sticky-Session Check ]
   - Blackbox Threat API Check                                   - 24-Hour IP Sticky Session
   - Cloudflare / WARP CIDR Bypass                               - Valid? ➔ Bypass Auth directly
   - Registration VPN Restriction                                              │
                 │                                                             ▼
                 ▼                                              [ Grace Period Fast-Reconnect ]
     [ Player Identity Resolution ]                              - Disconnected recently (< 120s)?
     - Geyser / Floodgate Bedrock (Auto-Auth)                   - Directly re-route to last server
     - Mojang Premium Cryptographic FastLogin                   (Lifesteal / Survival / Skyblock)
     - Cracked Player Password Verification                                    │
                 │                                                             ▼
                 ▼                                                  [ Target Server Router ]
     [ Embedded Netty Auth Server ]                              (Redis command sync & stats push)
     - Virtual World Dimension Codecs (1.16 - 1.21.11)
     - Argon2id / BCrypt Multi-Salt Hashing
     - Google Authenticator 2FA (TOTP)
     - Hijack & Lunar Skin UUID Protection

🛡️ Anti-Ban Evasion & Cloudflare WARP Handling (Staff SOP)

Section titled “🛡️ Anti-Ban Evasion & Cloudflare WARP Handling (Staff SOP)”

A major challenge on modern networks is handling players who use Cloudflare WARP (1.1.1.1) or VPNs to evade bans. Because Cloudflare assigns shared egress IPs (104.28.x.x) to thousands of users, careless IP bans can accidentally ban innocent players.

Below is the standard operational procedure (SOP) built into BharatMC Login:

1. The Rule: NEVER IP-Ban a Cloudflare WARP IP

Section titled “1. The Rule: NEVER IP-Ban a Cloudflare WARP IP”
  • If staff executes /ban-ip on a player connected via Cloudflare WARP (104.28.0.0/14 or 8.29.230.0/23), every innocent player sharing that WARP data-center node will be locked out.
  • Action: Always apply a standard UUID Account Ban (/ban <player>) first.

2. How the System Blocks WARP Ban-Evaders

Section titled “2. How the System Blocks WARP Ban-Evaders”

If a banned player reconnects via Cloudflare WARP:

  1. Existing Account Blocked: Their banned username/UUID cannot connect regardless of which IP WARP assigns them.
  2. Alt Creation Blocked by Registration Guard:
    • The banned player will attempt to register a new alternate account (/register).
    • Because allow-cloudflare-registration: false is enforced in antivpn.yml, the proxy immediately rejects the registration attempt: 
      ✕ REGISTRATION RESTRICTED
      You cannot register a new account while using a VPN, WARP, or Proxy.
      Please disconnect from your VPN/WARP and register directly.
  3. The Trap: To create an alt account, they must turn off WARP. The moment they turn off WARP, their Real Residential ISP IP is exposed and blocked by the existing IP ban!

3. Account-Chaining & Registration IP Audits (/dupeip)

Section titled “3. Account-Chaining & Registration IP Audits (/dupeip)”

When investigating a malicious user who switches VPNs:

  1. Run /dupeip <player>.
  2. Inspect the first_address (the residential IP where the account was originally registered) rather than their current last_address (which may be a temporary VPN).
  3. If staff bans the original first_address, all alternate accounts created from that same home connection are permanently linked and blocked.

4. Bedrock Device ID Banning

Section titled “4. Bedrock Device ID Banning”

For Bedrock players connecting through Geyser/Floodgate:

  • Bedrock packets transmit a unique DeviceId generated by the player’s phone, console, or Windows app.
  • VPNs and WARP change IP addresses but cannot change the hardware DeviceId.
  • Device bans completely neutralize mobile/console ban evaders across all alts.

⚡ Core Feature Matrix

Section titled “⚡ Core Feature Matrix”

1. Embedded Netty Virtual Auth Engine

Section titled “1. Embedded Netty Virtual Auth Engine”
  • Zero Backend Server Overhead: Unauthenticated players never touch a Paper/Spigot backend server. They are handled directly inside Velocity’s Netty event-loop pipelines.
  • Dynamic Dimension Codecs: Bundles raw NBT codecs for all Minecraft versions (codec_1_16.nbt through codec_1_21_11.nbt and codec_26_x.nbt). Whether a player joins from 1.16 or 1.21.4, the client receives the exact expected dimension tags without protocol errors or disconnects.
  • Input & Chat Isolation: Movement, item use, entity interactions, and public chat are intercepted and suppressed until the player completes /login or /register.

2. Cloudflare Zero Trust & 1.1.1.1 WARP Whitelisting

Section titled “2. Cloudflare Zero Trust & 1.1.1.1 WARP Whitelisting”

Many genuine players connect via Cloudflare 1.1.1.1 WARP or Zero Trust for routing optimization and DDoS security. Traditional anti-VPN plugins erroneously ban these players.

  • Dual-Action WARP System:
    • Whitelists Cloudflare’s published edge CIDR ranges (104.16.0.0/13, 172.64.0.0/13, etc.) plus dedicated WARP client egress blocks (104.28.0.0/14, 8.29.230.0/23).
    • Existing Accounts: Allowed to freely login using Cloudflare/WARP without interruption.
    • Registration Guard (allow-cloudflare-registration: false): Rejects brand-new registrations attempted over WARP. This blocks malicious players from mass-producing bot alt accounts.

3. Threat Shield & Anti-VPN (antivpn.yml)

Section titled “3. Threat Shield & Anti-VPN (antivpn.yml)”
  • Real-Time Threat Detection: Queries high-speed reputation intelligence (blackbox.ipinfo.app) with asynchronous non-blocking thread workers.
  • 7-Day IP Cache: Results are cached in memory and Redis for 7 days, ensuring sub-millisecond response times for recurring players.
  • Dynamic Whitelisting:
    • Bypass specific IP ranges: whitelisted-ips: ["127.0.0.1", "10.0.0.0/8"]
    • Bypass specific players: whitelisted-players or via /forcevpnwhitelist add <player>.

4. Hybrid Bedrock, Cracked & Premium FastLogin

Section titled “4. Hybrid Bedrock, Cracked & Premium FastLogin”
  • Bedrock Auto-Auth: Automatically detects Bedrock players connecting through Geyser / Floodgate (prefix *). If linked with their Xbox identity, they are logged in instantly without manual password typing.
  • Mojang Premium FastLogin: Legitimate Minecraft players can run /premium. The proxy performs an RSA/Mojang public key cryptographic handshake on subsequent logins, providing a cracked-server experience with authentic Mojang security.
  • Cracked Account Recovery: Players can revert to password protection at any time using /cracked.

5. Multi-Salt Password Encryption (Argon2id & BCrypt)

Section titled “5. Multi-Salt Password Encryption (Argon2id & BCrypt)”
  • Uses memory-hard Argon2id and BCrypt hashing with unique random salts per user.
  • Forbidden Password Dictionary: Blocks over 10,000 common and easily-guessable passwords (e.g. 123456, password, minecraft, admin).
  • Account Registration Caps: Enforces max-accounts-per-ip: 3 to permanently block bot attacks and automated alt generation.

6. Two-Factor Authentication (2FA / TOTP)

Section titled “6. Two-Factor Authentication (2FA / TOTP)”
  • Built-in time-based one-time password (TOTP) engine supporting Google Authenticator, Authy, and Microsoft Authenticator.
  • Mandatory for staff roles (bharatmc.admin, bharatmc.staff) to prevent credential stuffing and account hijacking.
  • Setup via /2fa setup (generates secret key and QR code instructions) and validated with /2fa verify <code>.

7. Sticky-IP Sessions & Grace Period Reconnect

Section titled “7. Sticky-IP Sessions & Grace Period Reconnect”
  • Sticky Sessions (session-expiry-hours: 24): If a player’s connection drops (or if they switch lobbies) and rejoins from the exact same verified IP, they bypass login authentication automatically.
  • Fast-Reconnect Grace Period (grace-period.seconds: 120):
    • If a player times out or experiences an accidental disconnect during combat or gameplay, they have 120 seconds to reconnect.
    • Instead of going through the Hub/Lobby, Velocity immediately restores their session and returns them directly to their last server (lifesteal, survival, skyblock).

8. Premium Username Hijack Protection & Cosmetic Skins

Section titled “8. Premium Username Hijack Protection & Cosmetic Skins”
  • Hijack Protection: Prevents cracked clients from spoofing the usernames of registered Mojang players or staff members.
  • Cosmetic / Lunar Client Skin UUID Fix: Preserves skin caches and cosmetic UUID hashes so Lunar/Badlion Client cloaks, hats, and wings render properly on offline-mode proxies.

9. Network Queue & Redis Analytics Heartbeat

Section titled “9. Network Queue & Redis Analytics Heartbeat”
  • Integrated Queue System (queue.enabled: true): Smoothly meters player join traffic during server restarts or peak events, preventing backend Paper servers from stalling during login spikes.
  • Real-Time Analytics Heartbeat: Reports aggregate player concurrency, registration rates, and proxy telemetry to Redis every 30 seconds (Asia/Kolkata timezone aligned).

📋 Complete Commands Reference

Section titled “📋 Complete Commands Reference”
Command Usage Permission Description
/login /login <password> Default Authenticate an existing account
/register /register <pass> <repeat> Default Register a new account password
/changepassword /changepassword <old> <new> Default Update existing account password
/premium /premium Default Enable automatic Mojang online-mode auto-login
/cracked /cracked Default Revert back to password prompt authentication
/2fa /2fa [setup|verify|disable] Default Manage Google Authenticator Two-Factor Security
/logout /logout Default Manually terminate active session
/glist /glist Default View all players distributed across network servers
/support /support Default View official Discord and web support channels
/auth reload /auth reload bharatmc.admin Hot-reload authentication configurations and IP filters
/unregister /unregister <player> bharatmc.admin Administrative reset for lost player passwords
/forceantivpn /forceantivpn [on|off|reload] bharatmc.admin Toggle or reload proxy Anti-VPN system
/forcevpnwhitelist /forcevpnwhitelist add <user> bharatmc.admin Whitelist a specific player to bypass VPN checks

🗄️ Database & Storage Architecture

Section titled “🗄️ Database & Storage Architecture”

BharatMC Login employs a dual database model:

  • PostgreSQL (database_main):
    • Persistent tables: users (UUID, hashed password, salt, 2FA secret, registration date, premium state), user_ips (historical IP audit trail), and ip_records (first registration IP anchor).
  • Redis (redis.internal:6379):
    • Fast session caching (bharatlogin:session:<uuid>).
    • Pub/Sub bus: Broadcasts bharatsync:player_login to alert game servers to dispatch pending store crates and keys.