1. Authentication Backend

The authentication protocol for older versions of Minecraft is quite unique. Instead of a single universal approach, each method seems to have been invented from scratch by different people. In any case, we need to understand the basics:

Endpoints

getsession

Method: POST

Accepts: username, password

Reply: sessionID (64 hex symbols) or 401

Verifies the username and password. If successful, it generates a session ID, stores it in the database, and returns it to the client. It is used for user authentication in the Launcher.

joinserver

Method: GET

Accepts: username, sessionID, serverID

Reply: OK (string) or 400/401

This is triggered by the client when attempting to connect to a Minecraft server. The backend verifies that the USER and Session ID match, and if successful, stores the serverId in the database. This links the user's session to a specific game server.

checkserver

Method: GET

Accepts: username, serverID

Reply: YES or NO (strings)

Used by the server to verify that the user has successfully authenticated and is associated with the current server (serverId). It cross-checks the data in the database.

haspaid

Method: GET

Accepts: username, sessionID

Reply: 200 or 400

Makes the client output "Unlicensed Copy :(" if it fails to check.

Example implementation

TODO

See also

See also: Exact file locations