Currently working on a MMO in pure Java. Wanted to make a launcher for the game that would allow the user to login. Trying my best to create a system that is secure and ensures only authenticated users can play.
Here is the system I’ve currently designed:
- User enters email and password in game launcher. Password is hashed, salted, and sent to Node login API
- Node checks MySQL database for correct username/password combination. If so, creates a unique token/session id and stores it in MySQL. This token is then sent back to the client.
- The sessionID is stored in plaintext on the player’s computer. The client connects to the server through a socket. It sends a packet with the token.
- The server checks the MySQL server to ensure the token matches, if it doesn’t, cut the connection.
Do you see any gaping holes in this system? Is there anything else I should be mindful of? What can I do to make it better?
Also, after the user is authenticated, is there anything else I should be mindful of during gameplay? Ex. should I be sending the session ID with all packets sent, in increments, etc.
Please let me know as I’m quite new to the world of auth 🙂