{"record":{"id":"d36981bb4eee3571","repo":"Pumpkin-MC/Pumpkin","slug":"cannot-accept-self-signed-token-authentication-is","errorCode":null,"errorMessage":"Cannot accept self-signed token. Authentication is enforced by server config.","messagePattern":"Cannot accept self-signed token\\. Authentication is enforced by server config\\.","errorType":"error_code","errorClass":"LoginError","httpStatus":null,"severity":"error","filePath":"crates/pumpkin/src/net/bedrock/login/mod.rs","lineNumber":40,"sourceCode":"use pumpkin_world::{CURRENT_BEDROCK_MC_PROTOCOL, CURRENT_BEDROCK_MC_VERSION};\nuse serde::{Deserialize, de::Error};\nuse serde_repr::Deserialize_repr;\nuse std::sync::Arc;\nuse thiserror::Error;\nuse tracing::debug;\nuse uuid::Uuid;\n\n#[derive(Debug, Error)]\npub enum LoginError {\n    #[error(\"Login packet data is not valid JSON\")]\n    InvalidTokenFormat(#[from] serde_json::Error),\n    #[error(\"JWT chain validation failed: {0}\")]\n    ChainValidationFailed(#[from] AuthError),\n    #[error(\"The validated username is invalid\")]\n    InvalidUsername,\n    #[error(\"Could not parse UUID from validated token\")]\n    InvalidUuid,\n    #[error(\"Cannot accept self-signed token. Authentication is enforced by server config.\")]\n    SelfSignedNotAllowed,\n    #[error(\"Got a guest/splitscreen login request. Currently unimplemented.\")]\n    GuestUnimplemented,\n    #[error(\"Failed to decode extra using decode_b64_url_nopad.\")]\n    DecodeExtraError,\n}\n\n#[derive(Deserialize_repr)]\n#[repr(u8)]\nenum AuthenticationType {\n    Full,\n    Guest,\n    SelfSigned,\n}\n\n#[derive(Deserialize)]\n#[serde(rename_all = \"PascalCase\")]\nstruct AuthPayload {","sourceCodeStart":22,"sourceCodeEnd":58,"githubUrl":"https://github.com/Pumpkin-MC/Pumpkin/blob/8d4639e25a57c15e47448ec327c780d41bbf2356/crates/pumpkin/src/net/bedrock/login/mod.rs#L22-L58","documentation":"This is the LoginError::SelfSignedNotAllowed variant. Bedrock clients may present a self-signed JWT chain (used for local/LAN play without Xbox Live). When the server is configured to enforce Xbox Live authentication, Pumpkin refuses these self-signed tokens outright. The library throws it to enforce the server's online-auth policy.","triggerScenarios":"A client that is not signed into Xbox Live (or a tool that self-generates its key pair) sends a self-signed JWT chain in the Login packet while the server config has authentication enforcement enabled.","commonSituations":"LAN or offline players trying to join an auth-enforced server, testing tools using self-generated certificates, or server operators who enabled authentication but expect offline clients to connect.","solutions":["Have the player sign into Xbox Live in their Bedrock client and reconnect","If offline/self-signed logins are acceptable for this server, disable enforced authentication in the server config and restart","If this is a test harness, generate a token through the real Xbox Live flow instead of self-signing","Communicate the requirement to the player: self-signed tokens can never bypass an auth-enforced server"],"exampleFix":"// before (pumpkin.toml)\n[authentication]\nenforce = true   # offline clients rejected\n// after (only if self-signed play is acceptable)\n[authentication]\nenforce = false  # allows self-signed/local tokens","handlingStrategy":"try-catch","validationCode":"// Before connecting, confirm the client holds a real Xbox Live token,\n// not a self-signed chain, when the server enforces auth\nfn can_attempt_login(has_xbox_token: bool, server_enforces_auth: bool) -> bool {\n    !server_enforces_auth || has_xbox_token\n}","typeGuard":"fn is_self_signed_rejected(e: &LoginError) -> bool {\n    matches!(e, LoginError::SelfSignedNotAllowed)\n}","tryCatchPattern":"match login_result {\n    Err(LoginError::SelfSignedNotAllowed) => {\n        disconnect_with(\"This server requires Xbox Live authentication. Sign in and retry.\")\n    }\n    Err(e) => disconnect_with(&format!(\"Login failed: {e}\")),\n    Ok(p) => admit(p),\n}","preventionTips":["Sign into Xbox Live before joining auth-enforced servers","Match the server's authentication config with your player base (offline vs online)","Never attempt to bypass enforcement with self-signed certificates","Document the auth requirement in your server's MOTD/rules"],"tags":["authentication","bedrock","minecraft","config","security"],"backgroundTag":"authentication-required","analyzedSha":"8d4639e25a57c15e47448ec327c780d41bbf2356","analyzedAt":"2026-09-09T15:32:22.916Z","contentChangedAt":"2026-09-09T15:32:22.916Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}