Account Login and Verification Support #835

CnCRAZER · 2025-09-25T03:29:24Z

Establishes 2 new flags within `ClientDefinitions.ini`:

UseCnCNetAPI
CnCNetAPIUrl

Setting UseCnCNetAPI to Yes or True allows online login window to connect to cncnet ladder account and retrieve active nicknames. Setting this flag to No or False hides this field entirely.

Verified Account Only Option

Introduces new UI windows and backend logic for CnCNet account login, nickname management, and user verification via the CnCNet API. Player list now displays verified status, and configuration options for API usage and endpoint are added.

Introduces a 'verified accounts only' setting for CnCNet multiplayer game creation and lobbies. Updates UI to allow hosts to restrict rooms to verified CnCNet accounts, enforces restriction on join and in the lobby, and propagates the setting through game creation and broadcast logic.

SadPencil · 2025-09-25T03:31:54Z

DXMainClient/DXGUI/Multiplayer/CnCNet/CnCNetLobby.cs

            string[] splitMessage = msg.Split(new char[] { ';' });

-            if (splitMessage.Length != 12)
+            if (splitMessage.Length < 12)


huh? Why changing the != operator instead of adding the number here?

ClientCore/ClientConfiguration.cs

github-actions · 2025-09-25T03:36:13Z

Nightly build for this pull request:

artifacts.zip
This comment is automatic and is meant to allow guests to get latest automatic builds without registering. It is updated on every successful build.

11EJDE11 · 2025-09-25T08:27:28Z

DXMainClient/DXGUI/Multiplayer/CnCNet/CnCNetAccountLoginPrompt.cs

+            {
+                Name = "lblWindowTitle",
+                FontIndex = 1,
+                Text = "CONNECT TO CNCNET"


L10N all the visible-to-user strings for translations.

I've pr'd this as draft with some things still needing to be polished. Can work on translations once everything seems good to go

Implement windows auth tokens alongside linux auth tokens for checkmark verification in nick lists

11EJDE11 · 2025-09-25T09:08:05Z

DXMainClient/DXGUI/Multiplayer/CnCNet/CnCNetLobby.cs

+            // Trigger verification after user list is received, if API is enabled
+            if (ClientConfiguration.Instance.UseCnCNetAPI)
+            {
+                currentChatChannel.UserListReceived += VerifyUserList;


UserListReceived is a list of users on the IRC channel with no ident info which would make verification impossible here if I'm not mistaken?

I believe so yeah. I used grants pr from 6 years ago for this and tried to update it. Having to go back and update things.

DXMainClient/Domain/Multiplayer/CnCNet/CnCNetAPI.cs

MahBoiDeveloper · 2025-09-25T09:37:40Z

DXMainClient/Domain/Multiplayer/CnCNet/CnCNetAPI.cs

+                {
+                    var request = new NameValueCollection();
+                    request.Add("email", email);
+                    request.Add("password", password);


Hash password with salt pls.

no need for an HTTPS connection. Only the database needs to hash the password with salt and it is out of the client's concern

no need for an HTTPS connection. Only the database needs to hash the password with salt and it is out of the client's concern

No real password should be transferred through the Internet, so client should implement hashing with salt too IMO.

HTTPS needs to remove MitM attack.

dude, HTTPS is considered safe, without mitm attacks unless the system ca is compromised

dude, HTTPS is considered safe, without mitm attacks unless the system ca is compromised

In Russia we have installed certificates from our local CA center that allows to get access to the banking sites and potentially get us under MittM HTTPS attack. So that is why I suggest to use HTTPS and hashing with salt to protect user's data.

all right...

If you hash on the client side, the hashed password becomes the actual password (with the hashing algorithm being nothing more than a means to convert a user-held mnemonic to the actual password).

This means that you will be storing the full "plain-text" password (the hash) in the database, and you will have lost all benefit of hashing in the first place.

If you decide to go this route, you might as well forgo any hashing and simply transmit and store the user's raw password (which, incidentally, I wouldn't particularly recommend).

https://security.stackexchange.com/a/8600

not really. We can have two layers of hashes. The database stores the 1st hash in plaintext; the client generates the 2nd hash from the 1st hash. 1st hash can be calculated using raw password and the salt

This is not what mah_boi proposes though.

the client generates the 2nd hash from the 1st hash.

doesn't that require transferring the hashed password/salt from server to client? isn't that a big no-no as the client could be malicious and use the obtained correct password hash to calculate locally what the password is?

no. the 1st hash is calculated from the raw password -- it won't be transmitted from the server to the client. The server stores the 1st only to enable an HTTP-digest-like challenge, removing the need of transferring plaintext password as well as removing the need to store the plaintext password in the database

MahBoiDeveloper · 2025-09-25T09:43:16Z

Btw there should be button Terms of Service or something that redirects to CnCNet's ToS of ladder usage.

MahBoiDeveloper · 2025-09-25T10:14:08Z

@CnCRAZER @SadPencil @SadPencil @Metadorius I find that FF's client ladder as lobbies with ladder icon in the regular lobby list (that neogrant's implement in old days) is a bit hacky instead of what we have right now in YR package -- separated button for quick matches in main menu. I suggest the future client's implementation of ladder API should follow the same idea -- separate window for searching quick matches in the ladder.

CnCRAZER · 2025-09-25T10:43:47Z

Btw there should be button Terms of Service or something that redirects to CnCNet's ToS of ladder usage.

The register button takes you to the ladder account creation page. Not the exact same thing but meh

Metadorius · 2025-09-25T11:55:41Z

I find that FF's client ladder as lobbies with ladder icon in the regular lobby list (that neogrant's implement in old days) is a bit hacky instead of what we have right now in YR package -- separated button for quick matches in main menu. I suggest the future client's implementation of ladder API should follow the same idea -- separate window for searching quick matches in the ladder.

While I don't have much experience with FF's client ladder implementation, I disagree with the notion that the concept itself is bad.

There is a ton of ways to implement ranking and/or ladder, including the one using regular lobbies. Age of Empires II uses ranked custom lobbies which only get counted towards the ELO if certain conditions are met, for example, and it works fine.
Having to upkeep two separate clients using separate tech and implementations is a big maintenance headache. From my knowledge, only @Sneer-ra2 upkeeps the ladder client. What if he's gone? None of the XNA client devs could replace him properly.

CnCRAZER · 2025-09-25T13:16:42Z

I wasn't expecting so much feedback so quickly lol.

So, currently: user has to go into an active ladder table and be sure they have an active username for the ladder to have the username show up in the login window. Am in talks with ladder api team to make a new non ladder api for generic lobbies.

Will wait for that before I do any more changes I think

CnCRAZER · 2025-09-25T13:18:56Z

Also curious on y'all's thoughts. @Metadorius @SadPencil @MahBoiDeveloper

Lets say a user decided to not use a cncnet account and use a nick of "xyz", but then a verified account logins with the same nick. Should the unverified account be kicked or told to change their name? Is this even possible? lol

MahBoiDeveloper · 2025-09-25T14:31:37Z

Lets say a user decided to not use a cncnet account and use a nick of "xyz", but then a verified account logins with the same nick. Should the unverified account be kicked or told to change their name? Is this even possible? lol

I believe that provide users logging only with email+password would solve issue.

Currently if unregistered user would connect with the same name that already exist in the IRC chat, it would be renamed with _ in the end, i.e. if I would make a fast reconnect to the Gamesurge IRC, my mah_boi nickname would stay in the net and new name would be mah_boi_.

If we talk about guests nicknames vs authorized nicknames, I prefer to kick guests or add them postfix like mah_boi (Guest) on logging and keep registered users without it.

Metadorius · 2025-09-25T20:38:17Z

Lets say a user decided to not use a cncnet account and use a nick of "xyz", but then a verified account logins with the same nick. Should the unverified account be kicked or told to change their name? Is this even possible? lol

I think the client could make requests to the API when logging in online, and if such account name exists as verified account -- then add an underscore like it does now.

CnCRAZER added 7 commits September 24, 2025 19:16

Update CnCNetAPI.cs

e7df572

Update CnCNetAPI.cs

1e38a76

House Keeping

f970d90

Fix multi-connection crashes

b3fa538

Relocate verified accounts only checkbox

494bd0e

SadPencil reviewed Sep 25, 2025

View reviewed changes

ClientCore/ClientConfiguration.cs Outdated Show resolved Hide resolved

CnCRAZER added 3 commits September 25, 2025 01:54

Clean UP

f9b2d7d

Clean Up

4fb853a

Fix typo in CnCNet API URL key

b56657f

11EJDE11 reviewed Sep 25, 2025

View reviewed changes

Try to fix verification

8275798

Implement windows auth tokens alongside linux auth tokens for checkmark verification in nick lists

11EJDE11 reviewed Sep 25, 2025

View reviewed changes

Update CnCNetAPI.cs

efc6bad

MahBoiDeveloper suggested changes Sep 25, 2025

View reviewed changes

Clean Up

09373a2

Uh oh!

Account Login and Verification Support #835

Are you sure you want to change the base?

Account Login and Verification Support #835

Conversation

CnCRAZER commented Sep 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Establishes 2 new flags within ClientDefinitions.ini:

Verified Account Only Option

Uh oh!

SadPencil Sep 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions bot commented Sep 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

MahBoiDeveloper Sep 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

SadPencil Sep 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

SadPencil Sep 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

MahBoiDeveloper commented Sep 25, 2025

Uh oh!

MahBoiDeveloper commented Sep 25, 2025

Uh oh!

CnCRAZER commented Sep 25, 2025

Uh oh!

Metadorius commented Sep 25, 2025

Uh oh!

CnCRAZER commented Sep 25, 2025

Uh oh!

CnCRAZER commented Sep 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

MahBoiDeveloper commented Sep 25, 2025

Uh oh!

Metadorius commented Sep 25, 2025

Uh oh!

Uh oh!

CnCRAZER commented Sep 25, 2025 •

edited

Loading

Establishes 2 new flags within `ClientDefinitions.ini`:

SadPencil Sep 25, 2025 •

edited

Loading

github-actions bot commented Sep 25, 2025 •

edited

Loading

MahBoiDeveloper Sep 25, 2025 •

edited

Loading

SadPencil Sep 25, 2025 •

edited

Loading

SadPencil Sep 25, 2025 •

edited

Loading

CnCRAZER commented Sep 25, 2025 •

edited

Loading