Talk:Legacy Mojang Authentication - Revision history

imported>Oxodao: Oxodao moved page Talk:Authentication to Talk:Legacy Mojang Authentication

2022-11-10T12:49:19Z

Oxodao moved page Talk:Authentication to Talk:Legacy Mojang Authentication

← Older revision	Revision as of 12:49, 10 November 2022
(No difference)

imported>P schneider: /* How to see what the vanila launcher does with the authoritation data */

2016-08-10T19:00:16Z

How to see what the vanila launcher does with the authoritation data

← Older revision		Revision as of 19:00, 10 August 2016
Line 50:		Line 50:
	https://gist.github.com/ferrybig/bab8c6f737be5f63189c		https://gist.github.com/ferrybig/bab8c6f737be5f63189c

	Using this class I discovered that ~~vanila~~ uses "requestUser":true to get more information about the user, including the ~~switch~~ access token. All information discovered by this can be useful to put into the main page.		Using this class I discovered that vanilla uses '''"requestUser": true''' to get more information about the user, including the Twitch access token. All information discovered by this can be useful to put into the main page.

imported>P schneider: /* Obtaining Twitch Access Token */ Comment about requestUser and the possible/known user parameters returned by Yggdrasil

2016-08-10T18:52:28Z

Obtaining Twitch Access Token: Comment about requestUser and the possible/known user parameters returned by Yggdrasil

← Older revision		Revision as of 18:52, 10 August 2016
Line 34:		Line 34:

	You must add ''''requestUser':true''' to the request when your are authenticating an user or refreshing an access token.		You must add ''''requestUser':true''' to the request when your are authenticating an user or refreshing an access token.

			Example request and response for '''requestUser''' have been added to the Article.
			The supplied Twitch token is an OAuth token that can be used to directly communicate with the Twitch API. (e.g. https://api.twitch.tv/kraken?oauth_token=...)
			So unlike '''preferredLanguage''' the '''twitch_access_token''' parameter has sensitive information that should not be shared or published in crash logs.
			I don't know where the the value for '''preferredLanguage''' can be set. For my account it is set to '''de''', which makes sense since I'm from Germany. I probably somewhere selected German when registering my Mojang/Minecraft account in March 2016. It looks like older accounts don't have this attribute. I know some people have it set to en and I assume there are many other language codes possible (ISO 639-1). --[[User:P schneider\|P schneider]] ([[User talk:P schneider\|talk]]) 18:52, 10 August 2016 (UTC)

	== How to see what the vanila launcher does with the authoritation data ==		== How to see what the vanila launcher does with the authoritation data ==

imported>Ferrybig: /* How to see what the vanila launcher does with the authoritation data */ new section

2014-11-16T13:57:07Z

How to see what the vanila launcher does with the authoritation data: new section

← Older revision		Revision as of 13:57, 16 November 2014
Line 34:		Line 34:

	You must add ''''requestUser':true''' to the request when your are authenticating an user or refreshing an access token.		You must add ''''requestUser':true''' to the request when your are authenticating an user or refreshing an access token.

			== How to see what the vanila launcher does with the authoritation data ==

			The vanilla launcher also talks using these server, but sometimes its usefull to see how vanila interacts with authserver.mojang.com to debug the process of your own launcher.

			The following code looks at the traffic between authserver.mojang.com and the local vanila client (the minecraft.jar downloaded from minecraft.net) and prints out the raw http contents inside the https stream.

			Use it only for debugging purposes, do NOT include it into malware minecraft launchers:

			https://gist.github.com/ferrybig/bab8c6f737be5f63189c

			Using this class I discovered that vanila uses "requestUser":true to get more information about the user, including the switch access token. All information discovered by this can be useful to put into the main page.

imported>Skyost: /* Obtaining Twitch Access Token */ new section

2014-06-24T12:18:40Z

Obtaining Twitch Access Token: new section

← Older revision		Revision as of 12:18, 24 June 2014
Line 30:		Line 30:

	Comes from Property.java in the Yggdrasil Authlib.		Comes from Property.java in the Yggdrasil Authlib.

			== Obtaining Twitch Access Token ==

			You must add ''''requestUser':true''' to the request when your are authenticating an user or refreshing an access token.

imported>Tsunko: /* Signature in textures */ new section

2014-05-22T05:50:20Z

Signature in textures: new section

← Older revision		Revision as of 05:50, 22 May 2014
Line 17:		Line 17:
	:So the URL I was really interested in was the checkserver one, i.e /game/checkserver.jsp?user=XXXX&serverId=XXXX - for which the response is quite similar: "3\r\nYES\r\n0\r\n\r\n" --[[User:Huin\|Huin]] 12:46, 21 November 2011 (MST)		:So the URL I was really interested in was the checkserver one, i.e /game/checkserver.jsp?user=XXXX&serverId=XXXX - for which the response is quite similar: "3\r\nYES\r\n0\r\n\r\n" --[[User:Huin\|Huin]] 12:46, 21 November 2011 (MST)
	::So this is actually HTTP chunking. See how you've got a <code>Transfer-Encoding: chunked</code> header? [http://en.wikipedia.org/wiki/Chunked_transfer_encoding] [[User:Barneygale\|Barneygale]] 09:08, 22 November 2011 (MST)		::So this is actually HTTP chunking. See how you've got a <code>Transfer-Encoding: chunked</code> header? [http://en.wikipedia.org/wiki/Chunked_transfer_encoding] [[User:Barneygale\|Barneygale]] 09:08, 22 November 2011 (MST)
			:::Facepalm. Yep. That'll be it. --[[User:Huin\|Huin]] 12:12, 22 November 2011 (MST)

			== Signature in textures ==

			The base64 in the "signature" section of "textures" is base64; it's just data signed with Yggdrasil's private key and is verified with a SHA1withRSA public key.

			Source:
			Signature signature = Signature.getInstance("SHA1withRSA");
			signature.initVerify(publicKey);
			signature.update(this.value.getBytes());
			return signature.verify(Base64.decodeBase64(this.signature));

			Comes from Property.java in the Yggdrasil Authlib.

imported>Barneygale at 16:08, 22 November 2011

2011-11-22T16:08:49Z

← Older revision		Revision as of 16:08, 22 November 2011
Line 12:		Line 12:

	:What URL specifically? [[User:Barneygale\|Barneygale]] 05:44, 21 November 2011 (MST)		:What URL specifically? [[User:Barneygale\|Barneygale]] 05:44, 21 November 2011 (MST)

			:Sorry - should have said: http://session.minecraft.net/game/joinserver.jsp?user=XXXX&sessionId=XXXX&serverId=XXXX I was having trouble with my implementation of the minecraft server (ChunkyMonkey), and decided to sniff the traffic that the official server was sending, and got the above. --[[User:Huin\|Huin]] 12:19, 21 November 2011 (MST)
			:Just realised that that was probably the client. I'm gonna run another packet sniff. --[[User:Huin\|Huin]] 12:21, 21 November 2011 (MST)
			:So the URL I was really interested in was the checkserver one, i.e /game/checkserver.jsp?user=XXXX&serverId=XXXX - for which the response is quite similar: "3\r\nYES\r\n0\r\n\r\n" --[[User:Huin\|Huin]] 12:46, 21 November 2011 (MST)
			::So this is actually HTTP chunking. See how you've got a <code>Transfer-Encoding: chunked</code> header? [http://en.wikipedia.org/wiki/Chunked_transfer_encoding] [[User:Barneygale\|Barneygale]] 09:08, 22 November 2011 (MST)

imported>Barneygale at 12:44, 21 November 2011

2011-11-21T12:44:50Z

New page

== New Base URL ==

Since the new base url used for authentication is https://login.minecraft.net/ does that mean it would use https://login.minecraft.net/getversion.jsp or https://login.minecraft.net/game/getversion.jsp ?

:The URL is just "https://login.minecraft.net/". Post straight there with the content "user=...&password=...&version=..." (without quotes). <b>~ [[User:Ribose|<span style="color:green">Ribose</span>]] · </b> 19:29, 20 October 2011 (MST)

== New auth response? ==

I'm now seeing the auth server respond with (in the HTTP body) the following: "2\r\nOK\r\n0\r\n\r\n" (interpret that as a C string). Anyone seen different, or have any insights?

--[[User:Huin|Huin]] 15:19, 20 November 2011 (MST)

:What URL specifically? [[User:Barneygale|Barneygale]] 05:44, 21 November 2011 (MST)