Summary of Changes

MCL-19983 Skin Fix

Per MCL-19983, this pull requests fixes skins in legacy versions of Minecraft by registering a custom HTTP protocol, to essentially override requests to the URL where skins used to be back then. The protocol uses authlib to fetch skins just like modern versions of Minecraft do.

I believe this is the only way to fix this skin issue, as skins used to be hosted at s3.amazonaws.com, it is unlikely it can be resolved server-side.

WEB-1429 Server Login Fix

As described in WEB-1429, it is currently impossible to join secured (online-mode=true) legacy servers. The game used to authenticate via minecraft.net, but this has since been moved. I have solved this using a custom HTTP handler which intercepts the server login request before it is performed, and uses Authlib to perform this request instead.

I believe this is the only suitable solution for this bug, as legacy minecraft versions are written to use HTTP rather than HTTPS, and include the access token in the URL, so handling this on the server side is insecure, and it should be done on the client side instead.

Additional Information

Since legacy Minecraft does not support the slim skin model, slim skins will be appropriately stretched out for the classic model. The screenshot below is an example of a slim skin.

I have also updated log4j, due to the infamous vulnerability, you can see #34 for more on that.

Deployment

Were this pull request accepted, to deploy the fix would require updating launcher manifest JSON files for legacy versions. The json files would need launchwrapper bumped to the latest version, and would need some additional dependencies for authlib, the same ones modern minecraft has. The new dependencies are:

• org.apache.logging.log4j:log4j-api:2.16.0
• org.apache.logging.log4j:log4j-core:2.16.0
• org.apache.logging.log4j:log4j-slf4j18-impl:2.16.0
• com.mojang:authlib:2.3.31
• com.google.code.gson:gson:2.8.0
• org.apache.commons:commons-lang3:3.5
• com.google.guava:guava:21.0
• commons-io:commons-io:2.5
• commons-codec:commons-codec:1.10

Testing Guidance

Skins

• Launch a legacy version using the new launchwrapper with any custom skin.
• Load into any world and after a moment your custom skin should appear.

Server Login

• Start a legacy server with an online-mode fix applied (you can find one here, there are many others.)
• Join the server.

This pull request seems well coded ! But I'm pretty sure it won't be included because Mojang no longer checks pull requests...

I really hope Mojang gets to working on this. I've been asking for a fix for 6-7 years now.

While it would be nice addition, sadly LegacyLauncher is somewhat abandoned (as it's also questionable in case of licence/ownership). I don't think it will be ever merged (but proof me wrong Mojang)

👍

While it would be nice addition, sadly LegacyLauncher is somewhat abandoned (as it's also questionable in case of licence/ownership). I don't think it will be ever merged (but proof me wrong Mojang)

Worth a shot!

I hope this gets fixed. Would like to have skins on old minecraft versions.

@craftycodie This looks like it could be reused even without LaunchWrapper.

Would you be OK with me using this in the MultiMC launcher startup jar?

Code is here: https://github.com/MultiMC/Launcher/tree/develop/libraries/launcher

And licensed under Apache 2.0.

@peterix it can indeed, I originally wrote this fix for my own launcher for legacy versions, it might be worth you having a look at that as it's protocol contains more fixes such as online-mode.

https://github.com/craftycodie/MineOnline/blob/main/src/main/java/gg/codie/mineonline/protocol/MineOnlineURLStreamHandler.java

Feel free!

this would also require setting minecraftArguments in the JSON to ${auth_player_name} ${auth_session} --gameDir ${game_directory} --assetsDir ${game_assets} --tweakClass net.minecraft.launchwrapper.AlphaVanillaTweaker for certain versions (most notably Alpha and earlier Beta versions)

this would also require setting minecraftArguments in the JSON to "${auth_player_name} ${auth_session} --gameDir ${game_directory} --assetsDir ${game_assets} --tweakClass net.minecraft.launchwrapper.AlphaVanillaTweaker" for certain versions (most notably Alpha and earlier Beta versions)

I think this is only required for Alpha 1.2.6.

@craftycodie This looks like it could be reused even without LaunchWrapper.

Would you be OK with me using this in the MultiMC launcher startup jar?

Code is here: https://github.com/MultiMC/Launcher/tree/develop/libraries/launcher

And licensed under Apache 2.0.

Did you end up adding that to MultiMC? Currently use PolyMC but would love for an easy fix.

@Mojang/Members

@Mojang accept it

Top 10 reasons to hate Mojang: 4. The length of time this PR has been open and the amount of reviews it has gotten without a response from Mojang

This is the most basic form of maintenance, and the fix has been sitting, ready to go for years.

Any updates on this issue?

At this point people should just use a mod like this. Mojang is ultimately self interested and unwilling to cooperate

SkinFix was implemented in PrismLauncher 8.0 with pull request https://github.com/PrismLauncher/PrismLauncher/pull/443

SkinFix was implemented in PrismLauncher 8.0 with pull request PrismLauncher/PrismLauncher#443

Because the community does what Ninten-- er, Mojang don't.

Seems like good PR

Does this fix include /whitelist add username user not found uuid endpoint error or is this only for older versions authentication & skins as stated? I know it is not called out, to be fair I did not check but hoping it does (apologies). Stellar job on these fixes by the way, thank you! It actually took a while to find ANY real info, the majority of results had a series of old issue logs on jira stating it's resolved then closed but I couldn't find an actual fix anywhere near the place. Until, perhaps, by accident, I stumbled in on an umpteenth jira post on which someone made a post that brought me here, thank you for that post too.