Slime Login

Sessions & trusted IPs#

Two ways a returning player skips the password. Both are on by default.

session:
  enabled: true
  duration-minutes: 60
  trusted-ip: true
  max-trusted-ips: 5

Sessions#

When a player authenticates, a session is opened for them. Reconnecting while it is still valid logs them straight back in:

[Slime] Session restored! Welcome back, BeboNaiem.
Option Meaning
duration-minutes: 60 How long a session lasts
duration-minutes: 0 Until the server (or proxy) restarts
enabled: false Always ask for the password

Sessions live in memory. They survive reconnects, not a restart.

Bound to the IP that created it

A session is only valid from the address it was opened from. Without that, anyone connecting with the same username would inherit it — in offline mode the UUID comes from the name, so the server cannot tell two people with the same name apart on its own.

Trusted IPs#

A longer-lived version of the same idea: once a player logs in successfully from an address, that address is remembered in the database. Next time they connect from it, no password:

[Slime] IP recognized! Welcome back, BeboNaiem.
Option Meaning
trusted-ip: true Remember addresses players log in from
max-trusted-ips: 5 Keep the 5 most recent; the oldest is dropped
max-trusted-ips: 0 Unlimited

Trusted IPs survive restarts. They are cleared when the player runs /unregister, or when an admin unregisters them.

Which one wins#

On join the plugin checks, in order:

  1. Trusted IP → logged in.
  2. Valid session → logged in.
  3. Verified premium → logged in.
  4. Otherwise → /login or /register.

Security trade-offs#

Both features trade a little safety for convenience. Consider your players' networks:

Situation Recommendation
Mostly home connections Defaults are fine
Players behind carrier-grade NAT / shared mobile IPs trusted-ip: false — many players share one address
Players on dynamic IPs that change often Keep trusted IPs; sessions alone will rarely help them
Highest security trusted-ip: false, duration-minutes: 5

Admins on cracked clients

A player with slimelogin.admin who is not Mojang-verified never inherits a session or a trusted IP — they must type the password every time. Someone guessing an admin's name from the same network would otherwise walk straight in.

Ending a session#