9da1d2e8ef
A full login hashed the password twice: once on the account login packet (0x80) and again on the game login (0x91). The second one re-authenticates a session authenticated milliseconds earlier, in the same process -- the auth id guarding it is only issued by PlayServer, which is reachable only after the first verify succeeded. Now that the id is bound to the account and address it was issued to, matching it is proof enough. Per-login game loop cost drops from ~17ms to ~8.5ms. An id that is unknown, expired, or from another address is treated as an invalid client and disconnected, which is what an unknown id already did. An id that is live but issued for a different account proves nothing, so that login falls back to verifying the password exactly as before. Also adds the missing return on the unknown-id path, which previously fell through with a default entry and nulled the client version. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| Application | ||
| BuildTool | ||
| Logger | ||
| Server | ||
| Server.Tests | ||
| UOContent | ||
| UOContent.Tests | ||