VelocityHybridAuth

Velocity Hybrid Auth

Velocity Hybrid Auth provides a local Yggdrasil hasJoined bridge for Velocity.

It implements the strict flow:

Try Mojang session verification.
If Mojang succeeds, accept as MOJANG.
If Mojang fails, check whether the username exists on Mojang.
If the Mojang username exists, deny and never try Ely.by.
If the username is not a Mojang username, try Ely.by session verification.
Accept valid Ely.by sessions; deny everything else.

There is no /login, no /register, and no cracked username fallback. How It Works

Velocity normally calls Mojang directly during the online-mode encryption handshake.

This plugin starts a local endpoint:

http://127.0.0.1:25585/session/minecraft/hasJoined

Velocity must call that endpoint instead of Mojang. The bridge then tries Mojang first, protects Mojang-owned names, and finally tries Ely.by with the same serverId. Required Velocity Launch Flag

For the most reliable setup, add this JVM flag before -jar velocity.jar:

-Dmojang.sessionserver=http://127.0.0.1:25585/session/minecraft/hasJoined

Example:

java -Dmojang.sessionserver=http://127.0.0.1:25585/session/minecraft/hasJoined -Xms128M -Xmx2048M -jar velocity.jar

The plugin also tries to set this property at startup, but the JVM flag is the reliable method because Velocity reads this value from an internal static field. Velocity Config

Recommended:

online-mode = true player-info-forwarding-mode = "modern" forwarding-secret-file = "forwarding.secret"

online-mode = true is fine here because Velocity is still doing a real online-mode handshake; the local bridge decides whether the session is Mojang or Ely.by.

If you keep online-mode = false, leave bridge.force-online-mode-in-pre-login=true in the plugin config so every login is forced through the online handshake. Paper Backend Config

Each Paper backend should use:

online-mode=false

In config/paper-global.yml:

proxies: velocity: enabled: true secret: "same-secret-as-forwarding.secret" online-mode: true

Backends must be firewalled so players cannot connect directly.

Logs

The bridge logs these action labels:

ACCEPT_MOJANG
ACCEPT_ELYBY
DENY_MOJANG_NAME_PROTECTED
DENY_NO_VALID_SESSION
DENY_AUTH_SERVICE_UNAVAILABLE
DENY_INVALID_USERNAME