# Security Notice ## Password Logging Issue ### Problem When using command-based authentication (`/register` and `/login`), **Plain text passwords may appear in server logs** because Bukkit/Paper/Spigot automatically logs all executed commands. Example log entry: ``` [Server thread/INFO]: Player issued server command: /register MyPassword123 MyPassword123 ``` ### Why This Happens - The Minecraft server logs all commands by default - This is a core server feature and cannot be disabled through plugins - Command filtering would require server configuration changes or log management tools ### Our Mitigations 1. **Password Cleared from Memory** - After hashing, passwords are immediately cleared from memory using `Arrays.fill()` - Prevents passwords from lingering in JVM memory 2. **BCrypt Hashing** - All passwords are hashed using BCrypt (cost factor 12) - Only password hashes are stored in the database - Even if the database is compromised, original passwords cannot be recovered 3. **Startup Warning** - Plugin displays a security warning when offline authentication is enabled - Reminds administrators to consider log filtering ### Recommended Solutions for Production #### Option 1: Log Filtering (Recommended) Configure your server's logging system to filter sensitive commands: **Using Log4j2 filters** (create `log4j2.xml` in server root): ```xml ``` #### Option 2: GUI-Based Password Entry Implement a chest GUI for password entry (future feature): - Players click items representing characters - No passwords typed in chat/commands - Nothing logged to console #### Option 3: External Authentication Use a web-based registration system: - Players register on your website - Plugin validates against external database - No passwords entered in-game ### What We Cannot Change - **Server command logging** - This is a Minecraft server core feature - **Plugin permissions** - Plugins cannot intercept or modify logs before they're written - **Backwards compatibility** - Changing to GUI-only would break existing workflows ### Database Security Even if logs are exposed: - **Passwords are BCrypt hashed** (12 rounds) - **Salted per-password** (BCrypt handles this automatically) - **Computationally expensive to crack** (~200ms per attempt) - **Rainbow table resistant** ### Best Practices for Server Administrators 1. **Restrict log access** - Only administrators should have access to server logs 2. **Rotate logs regularly** - Delete old logs after a retention period 3. **Use log filtering** - Implement the Log4j2 filter shown above 4. **Educate users** - Tell players not to reuse passwords from other services 5. **Monitor for breaches** - Watch for unauthorized access attempts ### Disclosure This security notice is provided in accordance with responsible disclosure practices. The password logging issue is an inherent limitation of command-based authentication in Minecraft and affects many similar plugins. ### Contact For security concerns or suggestions, please open an issue on the project repository. --- **Last Updated:** 2026