> For the complete documentation index, see [llms.txt](https://wiki.elytrium.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://wiki.elytrium.net/limboauth-clientmod/info.md).

# Info

{% embed url="<https://github.com/Elytrium/LimboAuth-ClientMod>" %}

[![Join our Discord](https://camo.githubusercontent.com/1185af6012f25cc9e1ec012ea5d7f0ed129d525a35def95f54c322f3d7526fff/68747470733a2f2f696d672e736869656c64732e696f2f646973636f72642f3737353737383832323333343730393738302e7376673f6c6f676f3d646973636f7264266c6162656c3d446973636f7264)](https://ely.su/discord)

A client mod for [LimboAuth](https://github.com/Elytrium/LimboAuth)\
Test server: [`ely.su`](https://hotmc.ru/minecraft-server-203216)

### Mod dependencies

* Architectury API

### Features of LimboAuth Client Mod

* Saves session tokens to the config file (`.minecraft/config/limboauth.yml`)
* You can set your own session token via the custom launcher

#### How does session token work

1. The server makes a token - a struct that contains an issue timestamp
2. The server signs this token with a private verify key (which you can see in the LimboAuth config)
3. The server sends the token to the client, the client saves it to the config file
4. When player joins the server, servers asks client if he has a session token
5. If the player has a session token, it sends it to the server
6. The server verifies the token via the private verify key

#### How to generate a session token

Pseudocode

```
# This key must be the same in the plugin config and in the server hash issuer
= = "testkey123"
= = unix_timestamp_millis ()
player_username = "TestPlayer123"

username_bytes = utf8.string_to_bytes(lower (player_username))
timestamp_bytes = big_endian.long_to_bytes(issue_timestamp)

# siphash 2-4 (default siphash) is used here
tokenhash = siphash.hash(verify_key, byte_concat(username_bytes, timestamp_bytes))
hash_bytes = big_endian.long_to_bytes(tokenhash)

token = base64.encode_to_string(byte_concat(timestamp_bytes, hash_bytes))
```

#### When does the token expire?

* The token expires if the player changes his password
* See ISSUEDTIME database field