EML version 2.6.0 announcement: Protect your profiles!
The EML ecosystem is taking a new step forward with the release of version 2.6.0. This update brings a highly anticipated feature to the EML AdminTool and EML Lib: Protected Profiles.
To maximize the power of Profiles, EML now allows you to hide certain profiles. This new feature also allows you to override maintenance mode.
Secure access for private servers
Until now, profiles managed through the EML AdminTool were public or only hidden. With v2.6.0, administrators can now restrict access to specific profiles. Whether you are running a private community server, testing an early-access modpack, or hosting an exclusive event, you can now require users to authenticate before they can download the profile’s files and launch the game.
How it works for players
For the end-user, the experience remains seamless. When a player attempts to access a protected profile, the launcher will prompt them for the profile’s password. Once authenticated, the EML Lib handles the rest, securely fetching the necessary tokens and downloading the required files without any additional friction.
Under the hood: security meets performance
Implementing this feature required a significant architectural overhaul to ensure both robust security and high performance. Here is what changed on the server side:
Scoped JWT authentication: Access is governed by JSON Web Tokens strictly scoped to individual profile slugs. This ensures that authenticating against one profile does not grant unintended access to others.
Smart rate limiting: To prevent brute-force attacks on passwords without penalizing legitimate users sharing a single IP address (such as university dorms or family networks), the authentication endpoint now utilizes a flexible action-window rate-limiting system.
Optimized file streaming: Serving protected files requires bypassing standard static file servers. EML AdminTool now securely streams files directly via Node.js readable streams. This includes real-time file size resolution for accurate download progress bars on the client side, all while maintaining a near-zero RAM footprint.
In-memory permission caching: To prevent database bottlenecks during heavy download spikes, user permissions are cached in-memory and evaluated instantly, dropping the database query cost for file downloads to zero.
EML Lib updates for developers
To support this, the EML Lib library has been updated. The Profile class now includes an auth(slug, password) method. Tokens are safely stored in memory and automatically injected into the headers of subsequent file download requests.
Additionally, the Downloader class has been refactored to distinguish between standard network errors and authentication rejections, preventing useless retry loops and providing immediate, clear feedback when access is denied.
Ready to update?
Upgrading to v2.6.0 is simple:
Update the EML AdminTool via the settings page.
Update your launcher project by running
npm i eml-lib@latest.
Read the docs for more information on how to use the new features.