SideGate [Bukkit]

What is SideGate?
SideGate is a Bukkit-compatible plugin (Spigot/Paper/Folia/Purpur) for servers that want to stay in online-mode=true but still allow selected non-premium players.

Premium players continue normal Mojang authentication, while approved guest players are handled by SideGate guest flow.

When Floodgate or Geyser-Spigot is installed, detected Bedrock players remain on the Bedrock authentication path and are not treated as SideGate guests.

SideGate 2.0.0 also supports Bukkit backends behind SideGate for Velocity. Velocity handles login decisions while Bukkit applies Guest messages and gameplay settings.

Links

• GitHub: https://github.com/TamKungZ/SideGate
• Documentation: https://dev.tamkungz.me/projects/sidegate
• CurseForge: https://www.curseforge.com/minecraft/bukkit-plugins/sidegate
• Modrinth: https://modrinth.com/plugin/sidegate
• SpigotMC: https://www.spigotmc.org/resources/sidegate-bukkit.131104
• Hangar: https://hangar.papermc.io/TamKungZ_/SideGate

Why use it?

• Keep premium security path for normal players.
• Avoid fully switching the whole server to offline mode.
• Control exactly who can join as guest.
• Apply clear guest restrictions and visual labels.

Core Features (Current)

• Selectable Login Engine: login-engine can use ProtocolLib, the built-in engine, or pick automatically (auto).
• Hybrid Login Flow: Premium users go through standard server authentication; guest candidates use SideGate injection flow.
• Manual Premium Override: premium-usernames always stay in premium path.
• Premium Session Failure Policy: Compare the login UUID with Mojang before encryption, then show a custom name-conflict message or continue as Guest.
• Guest Admission Policy: Use allow-all-guests or allowed-guests.
• Optional Auto-Detect: Mojang API lookup with internal cache (auto-detect-premium).
• Floodgate/Geyser Support: Automatically bypass guest classification for detected Bedrock players when either Bukkit plugin is installed.
• Fail-Closed Authentication: Mojang API failures leave players on normal online-mode authentication instead of granting guest access.
• Guest Handling: Add guest tag, set gamemode, send title/subtitle/messages.
• Guest Chat Prefix: Prefix applies to players with guest tag only.
• Runtime Reload: /sidegate reload.
• Public API: Addon plugins can integrate via SideGate API service.
• Velocity Backend Mode: Use proxy-mode.enabled to separate proxy authentication from Bukkit Guest actions.

Installation
Optional Bukkit dependency: https://www.spigotmc.org/resources/protocollib.1997/

1. Optionally install ProtocolLib (5.x+). Without it SideGate uses its built-in login engine.
2. Optionally install Floodgate and/or Geyser-Spigot for automatic Bedrock detection.
3. Put SideGate .jar in /plugins.
4. In standalone Bukkit mode, set online-mode=true in server.properties.
5. Start/restart server.

Configuration Example
Requirements

• Java: 17+
• Server: Spigot / Paper / Folia / Purpur (Bukkit-compatible)
• Optional dependency: ProtocolLib 5.x+ (https://www.spigotmc.org/resources/protocollib.1997/)
• Proxy mode: Bukkit backends do not use ProtocolLib.
• Optional integrations: Floodgate, Geyser-Spigot

Bug Reports
Report issues at:
https://github.com/TamKungZ/SideGate/issues

Please include:

• Server software + exact version
• Java version
• ProtocolLib version
• SideGate version
• Relevant startup/login logs

Project Status & License
Closed Source

• Normal server usage is allowed.
• Separate addon plugins using SideGate public API are allowed.
• Modification/redistribution/repackaging of SideGate is not allowed without permission.
• Commercial use or monetization requires prior permission by email: [email protected]

Public reference snapshot:
https://github.com/TamKungZ/SideGate ( sidegate-1.0.0-rc.1)

Security Notice
Guest/offline access has impersonation risk. For production servers, use an authentication plugin and strict permission setup.

If Mojang profile lookup is unavailable, SideGate does not assume the player is a guest. The server's normal online-mode authentication remains responsible for the login.

FALLBACK_TO_GUEST is a high-risk server-wide policy. It allows cracked clients to use Premium-registered usernames with Guest/offline UUIDs. Use an authentication plugin and UUID-based permissions.

The Premium session failure policy requires auto-detect-premium=true.

A client that deliberately spoofs the exact official UUID remains on normal online-mode authentication and cannot bypass Mojang session verification.

When using Velocity, configure secure player forwarding and never expose backend ports publicly.
Keep Velocity online-mode=true and set Bukkit backends to online-mode=false.
SideGate Velocity requires player-info-forwarding-mode="modern" and preserves login results already set by Floodgate or another proxy authentication plugin.

The encrypted-session FALLBACK_TO_GUEST mode is available only in standalone Bukkit mode. Velocity-routed Premium usernames must pass normal Mojang session verification, but SideGate Velocity can replace the generic invalid-session response with a configurable message.