Codie Stella
Comments
I don't know who moved this from the MCL project to MC but per the report
I see this as a launcher issue, as it can only be fixed with changes to the launchwrapper library, aka LegacyLauncher.
Please consider moving this issue back.
Hi Mojang,
I believe it is more appropriate to resolve this issue with an update to LegacyLauncher, as old versions of Minecraft use http, and server authentication can only be made secure (https) by patching the game. So, I've opened a pull request there for your consideration. You can find more information in the PR description.
Pull Request
Hi Mojang,
As mentioned in my previous comment, I believe it is more appropriate to resolve this issue with an update to LegacyLauncher. So, I've opened a pull request there for your consideration. You can find more information in the PR description.
Pull Request
https://github.com/Mojang/LegacyLauncher/pull/33
And to everyone else, please don't bury this comment with 'never gonna happen' replies, you're not helping 🙂
@unknown - Unfortunately the http implementation doesn't matter. The server may return a redirect but it can only do so after the request has already been made, the access token is already in http at this point.
Alex King - We do not need a "cracked infrastructure", we the community can already provide our own online-mode solutions leveraging the release server system.
As for doing ourselves, I have, repeatedly.
Here is a launcher which fixes this bug for every version https://github.com/craftycodie/MineOnline
You may also use many other popular third party launchers which support online-mode such as Betacraft.
Here is a server plugin, compatible with hmod bukkit and vanilla, fixing this bug for every version https://github.com/craftycodie/OnlineModeFix
You may also use other existing modded servers which fix online-mode.
In my previous comment I linked a PR into Mojang's own LegacyLaunch project which would fix online-mode.
Here is documentation on how to reimplement classic authentication via release authentication
https://docs.google.com/document/d/1EYi8pHoXFaxmcGTah09cKs3VAyx7n7OpJYmgBPok-jk/edit
The community have already moved, but solving this issue does not require "cracking" and piracy should certainly not be encouraged.
Hi Mojang,
Unfortunately this bug should not be fixed as stated in the description. Old versions of Minecraft using the old URL use HTTP rather than HTTPS, they also pass the player's access token via the URL. By reimplementing this endpoint, you would be handling access tokens in HTTP.
A secure alternative would be to leverage your "LegacyLauncher" library to hook the web request in Java before it is sent, and redirect it at that point. I already have an open PR into LegacyLauncher to fix a similar issue with this solution, I encourage you to take a look.
I would even be happy to write the code for this myself 🙂
Hi Alex King,
I am the creator of MineOnline, a third-party launcher which was created to solve this bug. I have been working within the legacy Minecraft community for over three years on mods, server software and web services, so I believe I'm qualified to answer your question.
With that said, Axel is right, the issue is unaffected by Microsoft authentication.
Online-mode authentication works in two parts:
A client sends Mojang the server they're connecting to, with a valid access token.
A server sends Mojang the name of the joining player to make sure they're allowed to join.
Whether you login with Microsoft or the legacy Mojang method, ultimately you will receive a Minecraft access token. So you can see, the migration process does not affect this issue at all.
I actually can't think of any potential issue this login change would cause. Nothing in game cares about how you get your access, it only cares that you got it.
Hope this helps.
reproduced on latest
Reproduced again using Mac launcher 2.2.7956 with Minecraft 1.7.7
Also requesting reopen.
@LaG
While it is true that 1.7.8 added UUIDs, this does not mean that skins have to be broken in legacy versions.
First off, usernames are unique, so a skin can be fetched by it's username.
Secondly, this isn't why skins are broken. Skins used to be hosted at https://s3.amazonaws.com/MinecraftSkins/. Mojang moved them to a new web address and stopped supporting the old one. It's still technically possible for Mojang to put skins at the old web address if they wish, though it would be technically difficult and costly (which is why I have attached a simple and free fix).
Finally. This is a bug is of the same nature of WEB-1429, which has been accepted and is scheduled for fix.
If this doesn't convince you, here's a link to the fix for this bug which has already been developed, and just needs to be accepted & released. This fix uses authlib, which is the same library, developed by Mojang, that release versions of Minecraft use to load skins. It loads them by UUID.
Reproduced on Windows 11
Launcher version
Windows 10.0 2.2.7264
Tuesday, November 2, 2021, 6:47:49 PM
2d6a19b87068a5bdd5421a35af9fc8099844a748
[media][media]Reproduced on Mac OS Big Sur 11.6
Launcher version
10.16.0 2.2.7268
Tuesday, November 2, 2021, 6:51:10 PM
2d6a19b87068a5bdd5421a35af9fc8099844a748
[media][media]@Umija5895 Please do not remove affected versions. I have reproduced this bug on the latest launcher across Windows 10 and Mac OS including the new Windows 10 UWP launcher. I have not tried the legacy launcher, though it's probably broken too.
This is not an issue. The behaviour is consistent with sand, gravel, anvils.
I have opened a pull-request to fix this issue on GitHub. I have included a description of the fix and how to deploy it.
Could a mod please move this back to the launcher project please? Thank you