exzork / gcauth

Authentication system for Grasscutter

Hi 👋, I'm Muhammad Eko Prasetyo

Past Projects

• Online E-Voting System for informatics department at my univ using CodeIgniter 4 URL:Replica EvoteCI
• Offline/Online E-Voting System for my OOP Course Repo:EvoteJava
• Handwriting Javanese Character Recognition for my Computer Vision Course Repo:Aksara NN
• Decision Support System for Credit Card Category using Bayes Algorithm, native PHP and Bootstrap 3 URL:SPK Credit

Connect with me:

Languages and Tools:

Support:

gcauth's Issues

Using insecurity pseudo random number generator when generate key used to sign the JWT.

Hi, we are a research group to help developers build secure applications. We designed a cryptographic misuse detector on Java language(Our main concern is the secure implementation and use of Json Web Token). We found your great public repository (i.e.,GCAuth) from Github, and several security issues detected by our detector are shown in the following. The specific security issues we found are as follows:
(1) Location: Package: package me.exzork.gcauth.utils; Class: Authentication.class
Security issue: Using insecurity PRNG to generate key. (public static String generateRandomNumber(int length) method)

Math.random() is not a cryptographically secure PRNG, and keys used in the cryptographic algorithms should be derived from a cryptographically secure random number generator (such as SecureRandom), we recommend that you use a secure PRNG to generate keys.

We wish the above security issues cloud truly help you to build a secure application. If you have any concern or suggestion, please feel free to contact us, we are looking forward to your reply. Thanks.

2.7 Grasscutter changed this method

GCAuth/src/main/java/me/exzork/gcauth/utils/Authentication.java

Line 74 in ac1c4b5

.withClaim("uid", account.getPlayerUid())

Error with 2.7

I tried with 2.7 Grasscutter and error on login

Exception in thread "main" java.lang.NoSuchFieldError: DebugMode at me.exzork.gcauth.GCAuth.lambda$onEnable$1(GCAuth.java:94) at io.javalin.core.JavalinConfig.applyUserConfig(JavalinConfig.java:205) at io.javalin.Javalin.create(Javalin.java:89) at express.Express.<init>(Express.java:39) at me.exzork.gcauth.GCAuth.onEnable(GCAuth.java:50) at emu.grasscutter.plugin.PluginManager.lambda$enablePlugins$2(PluginManager.java:116) at java.base/java.util.HashMap.forEach(HashMap.java:1420) at emu.grasscutter.plugin.PluginManager.enablePlugins(PluginManager.java:114) at emu.grasscutter.Grasscutter.main(Grasscutter.java:100)

Exception in thread "main" java.lang.NoSuchFieldError: DebugMode
at me.exzork.gcauth.GCAuth.lambda$onEnable$1(GCAuth.java:94)
at io.javalin.core.JavalinConfig.applyUserConfig(JavalinConfig.java:205)
at io.javalin.Javalin.create(Javalin.java:89)
at express.Express.(Express.java:39)
at me.exzork.gcauth.GCAuth.onEnable(GCAuth.java:50)
at emu.grasscutter.plugin.PluginManager.lambda$enablePlugins$2(PluginManager.java:116)
at java.base/java.util.HashMap.forEach(HashMap.java:1420)
at emu.grasscutter.plugin.PluginManager.enablePlugins(PluginManager.java:114)
at emu.grasscutter.Grasscutter.main(Grasscutter.java:100)

无法启用插件：GCAuth_OAuth

ERROR:PluginManager 无法启用插件：GCAuth_OAuth
java.lang.NoClassDefFoundError: emu/grasscutter/Configuration
at com.xtaolabs.gcauth_oauth.GCAuth_OAuth.onEnable(GCAuth_OAuth.java:23)
at emu.grasscutter.plugin.PluginManager.lambda$enablePlugins$2(PluginManager.java:201)
at java.base/java.util.LinkedHashMap.forEach(LinkedHashMap.java:721)
at emu.grasscutter.plugin.PluginManager.enablePlugins(PluginManager.java:198)
at emu.grasscutter.Grasscutter.main(Grasscutter.java:160)
Caused by: java.lang.ClassNotFoundException: emu.grasscutter.Configuration
at java.base/java.net.URLClassLoader.findClass(URLClassLoader.java:445)
at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:587)
at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:520)
... 5 common frames omitted

hello

Hello, I used the plug-in and ran successfully. So how can I register or change my password?

Could not register successfully.

Is that means I have to replace the grasscutter's default certificate with a legal domain certificate?

[GCAuth] 客户端 1005 试图使用无效的一次性令牌登录。

[GCAuth] 客户端 1005 试图使用无效的一次性令牌登录。你好，根据指引，我找了这里，虽然我没有安装这个插件，但是依然出现了这个错，请问是为什么，

Hello, I'm sorry to bother you. How can I modify this prompt in the game

In version 2.2.1, the tool will not be able to get the status of the plug-in, but it can still register and log in and change the password. I don't know if this is the problem of the new version

[suggestion] Consider using `Plugin#getDataFolder`

Instead of using ./plugins/(name) plugins should consider switching to the Plugin#getDataFolder method introduced in v1.0.3-dev.

[BUG] return HTTP 500 on all endpoints with no errors in console

Example output on register endpoint: curl -i -X POST http://localhost:444/authentication/register -H 'Content-Type: application/json' -d '{username: "123", password: "123", password_confirmation: "123"}'

HTTP/1.1 500 Server Error
Date: Fri, 11 Nov 2022 07:12:35 GMT
Content-Type: text/plain
Content-Length: 0
Server: Jetty(9.4.48.v20220622)

accessKey Not set in config

Grasscutter Ver: 1.4.4-dev-05fe62b4

Trying to login to Genshin: Getting OTP invalid

How can I fix this error?
Any help is appreciated.

[suggestion] Consider using `Plugin#getLogger`

self explanatory, plugins have their own loggers now

OTP INVALID