Sign in with Minecraft.
No passwords involved.

interface TokenSuccess {
  status: 'success';
  message: string;
  uuid: string;     // lower-case, with dashes
  username: string;
}

interface TokenFailure {
  status: 'fail';
  message: string;
}

export interface MinecraftUser {
  uuid: string;
  username: string;
}

const BASE_URL = 'https://auth.aristois.net';

/** Redeems a single-use code. Returns null if it is invalid, expired or already used. */
export async function redeem(code: string, origin?: string): Promise<MinecraftUser | null> {
  if (!/^\d{6}$/.test(code)) return null;

  const url = new URL(`/token/${code}`, BASE_URL);
  if (origin) url.searchParams.set('origin', origin);

  const response = await fetch(url, { signal: AbortSignal.timeout(10_000) });
  if (response.status === 403 || response.status === 404) return null;
  if (!response.ok) throw new Error(`authentify returned HTTP ${response.status}`);

  const data = (await response.json()) as TokenSuccess | TokenFailure;
  return data.status === 'success'
    ? { uuid: data.uuid, username: data.username }
    : null;
}

// Usage: a player typed the code from the Minecraft kick screen into your form
const user = await redeem('123456');
if (user) console.log(`Logged in as ${user.username} (${user.uuid})`);

import { randomBytes, timingSafeEqual } from 'node:crypto';
import express from 'express';
import session from 'express-session';
import { redeem, type MinecraftUser } from './authentify.js'; // the redeem() example

declare module 'express-session' {
  interface SessionData {
    authentifyState?: string;
    user?: MinecraftUser;
  }
}

const SITE = 'https://example.com';
const app = express();
app.use(session({ secret: process.env.SESSION_SECRET!, resave: false, saveUninitialized: false }));

// 1. Send the player to authentify with a random state bound to their session
app.get('/login', (req, res) => {
  const state = randomBytes(32).toString('hex');
  req.session.authentifyState = state;

  const target = new URL('https://auth.aristois.net/auth');
  target.searchParams.set('redirect', `${SITE}/login/callback`);
  target.searchParams.set('state', state);
  res.redirect(target.href);
});

// 2. authentify sends them back with ?code=123456&state=...
app.get('/login/callback', async (req, res) => {
  const expected = req.session.authentifyState;
  delete req.session.authentifyState;

  const state = Buffer.from(String(req.query.state ?? ''));
  if (!expected || state.length !== expected.length || !timingSafeEqual(state, Buffer.from(expected))) {
    res.status(400).send('Invalid login state');
    return;
  }

  const user = await redeem(String(req.query.code ?? ''), SITE);
  if (!user) {
    res.status(403).send('Invalid or expired code');
    return;
  }

  req.session.user = user;
  res.redirect('/');
});

app.listen(3000);

import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
import com.fasterxml.jackson.databind.ObjectMapper;

import java.io.IOException;
import java.net.URI;
import java.net.URLEncoder;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.nio.charset.StandardCharsets;
import java.time.Duration;
import java.util.Optional;
import java.util.UUID;

public final class Authentify {

    @JsonIgnoreProperties(ignoreUnknown = true)
    public record TokenResponse(String status, String message, String uuid, String username) {}

    public record MinecraftUser(UUID uuid, String username) {}

    private static final String BASE_URL = "https://auth.aristois.net";
    private static final ObjectMapper JSON = new ObjectMapper();
    private static final HttpClient HTTP = HttpClient.newBuilder()
            .connectTimeout(Duration.ofSeconds(5))
            .build();

    private Authentify() {}

    /**
     * Redeems a single-use code.
     *
     * @param origin your site's origin, e.g. "https://example.com", or null
     * @return the player, or empty if the code is invalid, expired or already used
     */
    public static Optional<MinecraftUser> redeem(String code, String origin)
            throws IOException, InterruptedException {
        if (code == null || !code.matches("\\d{6}")) {
            return Optional.empty();
        }

        String url = BASE_URL + "/token/" + code;
        if (origin != null) {
            url += "?origin=" + URLEncoder.encode(origin, StandardCharsets.UTF_8);
        }

        HttpRequest request = HttpRequest.newBuilder(URI.create(url))
                .timeout(Duration.ofSeconds(10))
                .header("Accept", "application/json")
                .GET()
                .build();
        HttpResponse<String> response = HTTP.send(request, HttpResponse.BodyHandlers.ofString());

        int status = response.statusCode();
        if (status == 403 || status == 404) {
            return Optional.empty();
        }
        if (status != 200) {
            throw new IOException("authentify returned HTTP " + status);
        }

        TokenResponse body = JSON.readValue(response.body(), TokenResponse.class);
        if (!"success".equals(body.status())) {
            return Optional.empty();
        }
        return Optional.of(new MinecraftUser(UUID.fromString(body.uuid()), body.username()));
    }
}

// Usage
Authentify.redeem("123456", null).ifPresentOrElse(
        user -> System.out.println("Logged in as " + user.username() + " (" + user.uuid() + ")"),
        () -> System.out.println("Invalid or expired code"));

import jakarta.servlet.annotation.WebServlet;
import jakarta.servlet.http.HttpServlet;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import jakarta.servlet.http.HttpSession;

import java.io.IOException;
import java.net.URLEncoder;
import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.security.SecureRandom;
import java.util.HexFormat;
import java.util.Optional;

public final class LoginServlets {

    static final String SITE = "https://example.com";
    private static final SecureRandom RANDOM = new SecureRandom();

    // 1. Send the player to authentify with a random state bound to their session
    @WebServlet("/login")
    public static final class Start extends HttpServlet {
        @Override
        protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws IOException {
            byte[] bytes = new byte[32];
            RANDOM.nextBytes(bytes);
            String state = HexFormat.of().formatHex(bytes);
            req.getSession().setAttribute("authentifyState", state);

            String callback = URLEncoder.encode(SITE + "/login/callback", StandardCharsets.UTF_8);
            resp.sendRedirect("https://auth.aristois.net/auth?redirect=" + callback + "&state=" + state);
        }
    }

    // 2. authentify sends them back with ?code=123456&state=...
    @WebServlet("/login/callback")
    public static final class Callback extends HttpServlet {
        @Override
        protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws IOException {
            HttpSession session = req.getSession();
            String expected = (String) session.getAttribute("authentifyState");
            session.removeAttribute("authentifyState");

            String state = req.getParameter("state");
            if (expected == null || state == null || !MessageDigest.isEqual(
                    expected.getBytes(StandardCharsets.UTF_8), state.getBytes(StandardCharsets.UTF_8))) {
                resp.sendError(400, "Invalid login state");
                return;
            }

            Optional<Authentify.MinecraftUser> user;
            try {
                user = Authentify.redeem(req.getParameter("code"), SITE);
            } catch (InterruptedException e) {
                Thread.currentThread().interrupt();
                resp.sendError(503);
                return;
            }
            if (user.isEmpty()) {
                resp.sendError(403, "Invalid or expired code");
                return;
            }

            req.changeSessionId(); // prevent session fixation
            session.setAttribute("user", user.get());
            resp.sendRedirect("/");
        }
    }
}