No-Premium User can enter with premium name

[SeruhioX]

A few days ago a user came with the name "tonacho" which is a famous youtuber, obviously it is not him and his UUID is not the one of his premium account either.

https://es.namemc.com/profile/tonacho.1

01:47:22 [INFORMACIÓN] Loaded player §9tonacho§7 (4c9cde18-09c5-3e89-9475-4c735eb7afce)

Config:
https://pastebin.com/k6Wqhq22

I do not know exactly how he does it, since I've tried to enter with a premium name with a non-premium launcher and I can't.

Plugin list:

In Bungee: LuckPerms, BungeeTabListPlus, BuycraftX, DeluxeChat, FastLogin, LiteBans, SkinsRestorer, Yamler-Bungee

Environment description

Bungeecord Network (BungeeCord 1​28​6) MYSQL

Plugin version or build number (don't write latest):

#780 (1.11-25c725f)

[TuxCoding]

Already existing users before the FastLogin installation are assumed to be cracked and therefore can still login and play.

[SeruhioX]

Can not do anything about it?
There are users who did their accounts years ago and I would not like them to enter with their name in a non-premium launcher

[TuxCoding]

Just unregister them. FastLogin asks your login plugin at the moment they want to join your server.

[SeruhioX]

"cracked player cannot register an account for the premium player and so cannot the steal the account"

I always believed that this meant that a user with a non-premium launcher could not use an existing account in the minecraft database.

Then nothing can be done and I must assume that there are users who can impersonate others who have a premium account by entering their name?

It's not that it's a big problem, but if there was some way to fix it that is not manual (and that does not allow this to happen), I would ask you to implement it if possible...

[TuxCoding]

"cracked player cannot register an account for the premium player and so cannot the steal the account"
I always believed that this meant that a user with a non-premium launcher could not use an existing account in the minecraft database.

See line 11 in the config.

It's not that it's a big problem, but if there was some way to fix it that is not manual (and that does not allow this to happen), I would ask you to implement it if possible...

Just use auto purge from your auth plugin. Many have this option implemented.

[SeruhioX]

I think I did not express myself well, this user did not exist in AuthMe, I had no previous players when I install this plugin (FastLogin) since my server was premium, that is, I installed fastlogin together with authme.

[TuxCoding]

Please post the BungeeCord log at the moment the user tried to login.

[SeruhioX]

https://hastebin.com/ononegenut.xml

[TuxCoding]

Could post the startup log too, because I see no debug messages of FastLogin at all.

[SeruhioX]

https://hastebin.com/ficehequbi.sql

[TuxCoding]

Are you sure that's the first time a player with that name logged into the server and do you see any messages about rate-limiting?

[SeruhioX]

https://hastebin.com/tunenujasi.hs
This log is the first time this user entered

And now that you mention it, from time to time two errors come out, although they do not have to do with this user

18:39:26 [INFORMACIÓN] [FastLogin] RATE_LIMIT REACHED

https://hastebin.com/yopugurate.swift

[TuxCoding]

That's the reason. FastLogin cannot at that time if that player is premium or not. So it will assume all are cracked. I should make the rate limit message more informative.

[SeruhioX]

I understand that the limit is 600 requests every 10 minutes, my server is small, I have an average of 30-40 people, it is impossible to reach that limit.

Am I wrong with the limit?