Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/kenzz55/ue5-iocp-mmo-server/llms.txt

Use this file to discover all available pages before exploring further.

The AuthServer is an ASP.NET Core Minimal API application responsible for account registration, login, and issuing short-lived enter tokens that the C++ GameServer validates before admitting a player. All runtime configuration is read from appsettings.json (or environment-variable overrides following the standard ASP.NET Core configuration hierarchy), so no recompilation is needed to change database endpoints, token expiry times, or login policies.

​
Full appsettings.json reference

The file below shows every supported section with its default or recommended values filled in. 
{
  "Logging": {
    "LogLevel": {
      "Default": "Information",
      "Microsoft.AspNetCore": "Warning"
    }
  },
  "Database": {
    "ConnectionString": "Server=127.0.0.1;Port=3306;Database=game;User=game;Password=s3cur3_g@me_pass;"
  },
  "Redis": {
    "Configuration": "127.0.0.1:6379"
  },
  "Tokens": {
    "AccessTokenMinutes": 60,
    "EnterTokenSeconds": 60,
    "DuplicateLoginPolicy": "InvalidatePrevious"
  },
  "AllowedHosts": "*"
}

​
Database section

FieldTypeDescription
ConnectionStringstringA standard MySqlConnector connection string pointing to the MariaDB/MySQL instance that holds the game schema. Minimum required components: Server, Port, Database, User, Password.
Example connection string formats: 
Server=127.0.0.1;Port=3306;Database=game;User=game;Password=yourpassword;
Server=db.internal;Database=game;User=game;Password=yourpassword;SslMode=Required;

​
Redis section

FieldTypeDefaultDescription
Configurationstring127.0.0.1:6379StackExchange.Redis connection string. Append ,password=yourpassword to authenticate, or use a full Redis URL. Multiple endpoints can be comma-separated for cluster/sentinel setups.

​
Tokens section

FieldTypeDefaultDescription
AccessTokenMinutesinteger60Lifetime of an access token in minutes. The token is stored in Redis with this TTL and expires automatically. Clients must re-login after expiry.
EnterTokenSecondsinteger60Lifetime of a one-time enter token in seconds. The token is issued when a player selects a game server and must be presented to the GameServer before it expires.
DuplicateLoginPolicystring"InvalidatePrevious"Controls behavior when a second login request arrives for an account that already has an active session. See the Token lifecycle section below.

​
Logging section

Standard ASP.NET Core log-level configuration. Microsoft.AspNetCore is set to Warning by default to suppress noisy request-routing messages in production.
LevelMeaning
TraceVerbose — include all internal framework events
DebugDiagnostic detail useful during development
InformationNormal operational events (startup, request summaries)
WarningUnexpected but recoverable situations
ErrorFailures that need attention
CriticalFatal errors causing process termination

​
Token lifecycle

The AuthServer uses Redis exclusively for token storage. No JWT signing keys are required. 
  Client          AuthServer               Redis
    |                  |                     |
    |--- POST /auth/login ----------------->|
    |                  |-- SET auth:access:<token>  (TTL = AccessTokenMinutes) -->|
    |                  |-- SET account:session:<id> (TTL = AccessTokenMinutes) -->|
    |<-- { accessToken } ---------------------
    |                  |                     |
    |--- POST /auth/select-server ---------->|
    |                  |-- GET auth:access:<token> --------------------------->|
    |                  |-- SET game:enter:<enterToken>  (TTL = EnterTokenSeconds, NX) -->|
    |<-- { ip, port, enterToken, characterId }
AccessToken — A 32-byte cryptographically random hex string stored in Redis under auth:access:<token> with a value of <accountId>|<nickname>. A parallel key account:session:<accountId> holds the current token and allows duplicate-login detection. EnterToken — A second 32-byte random hex string stored under game:enter:<enterToken> with value <accountId>|<serverId>|<characterId>|<nickname>. It is written with NX (set-if-not-exists) to prevent replay and expires after EnterTokenSeconds. The C++ GameServer reads and deletes this key when a client connects. DuplicateLoginPolicy controls what happens when a second /auth/login arrives while a session key already exists in Redis:
PolicyBehavior
InvalidatePreviousThe existing access token is deleted from Redis before issuing the new one. The first client’s token becomes invalid immediately.
RejectNewThe new login request is rejected with HTTP 409 Conflict and the message "already logged in". The existing session remains active.

​
Input validation rules

The following constraints are enforced in Program.cs before any database call is made. Requests that fail validation receive HTTP 400 Bad Request.
FieldMin lengthMax lengthNotes
account4 characters64 charactersMust not be null or whitespace
password8 characters128 charactersMust not be null or whitespace
nickname2 characters32 charactersOptional at registration; defaults to the account name if omitted. Values longer than 32 characters are truncated automatically.
Passwords are hashed with PBKDF2-SHA256 (210,000 iterations) via the Pbkdf2PasswordHasher service before being stored in the database.

​
Running and publishing

Use dotnet run during development — the runtime automatically picks up changes to appsettings.json and appsettings.Development.json. For production deployments, publish a self-contained binary with dotnet publish -c Release and place a production appsettings.json (or set environment variables such as Database__ConnectionString) alongside the executable. Never embed production credentials in the repository.
# Development
cd ServerSolution/AuthServer
dotnet run

# Production build
dotnet publish -c Release -o ./publish
./publish/AuthServer

Build docs developers (and LLMs) love

Get started for freeTalk to us