Implement CUO Web Identity Packet

[raydienull]

Change the network logic for Web Identity packet of the CUO

https://github.com/ClassicUO/packets/blob/main/README.md

This packets is sended, in the Server login logic, just when player send the seed and game credentials

[mtwango]

Current issue: 15:27:WARNING:11:Client connected with a seed length of 149 exceeding max length limit of 127, disconnecting.

This is the packet used: https://docs.polserver.com/packets/index.php?Packet=0xA4

The packet is sent after player selects shard from list on login screen. It looks like this goes to CNetworkInput::processUnknownClientData because of unknown connection type.

By my testing, I was able to figure out probable workflow:

1. player uses login button with username / password. This verifies, that account is valid
2. The shard list is displayed
3. Player clicks on selected shard, web client disconnects from game server and reconnects sending packet 0xA4
4. Sphere rejects this packet, since the connection type is unknown and the length of unknown packets is limited to 127 characters:

   Source-X/src/network/CNetworkInput.cpp

   Line 544 in 758bfe7

   g_Log.EventWarn("%x:Client connected with a seed length of %u exceeding max length limit of %d, disconnecting.\n",

I tried sending packet after / before 0xA0, but once you establish connection via 0x80 login packet, it works ok.

If anybody is able to provide packets log from debug build, I would be grateful, since I'm not able to run it on live server (cannot install visual studio there and its on Windows :()

[mtwango]

If I increase the limit to bypass unk packet size limit, I still hit the wall with:

17:04:1:Client connected [Total:1]. IP='127.0.0.1'. (Connecting/Connected: 1/1).
17:04:DEBUG:1:Odd login message length 149?
17:04:DEBUG:1:client->server Packet len=149 id=0xa4 [2025/09/08 17:04:31]
        0  1  2  3  4  5  6  7   8  9  A  B  C  D  E  F
       -- -- -- -- -- -- -- --  -- -- -- -- -- -- -- --
0000   a4 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
0010   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
0020   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
0030   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
0040   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
0050   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
0060   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
0070   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
0080   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
0090   00 00 00 00 00                                    .....

17:04:WARNING:1:Bad Login 10. Encryption error: packet length does not match what was expected.
17:04:1:Client disconnected [Total:0]. Connection Type: 'ServerList or CharList?'. IP='127.0.0.1'.

Real packet communication will be needed to evaluate this issue more

[Jhobean]

I can test it on my Debug VS, what you need exaclty? I must connect via cuo web?

I can share a remote desktop acces on a VM with VS debuger too. Talk to me on discord if needed

[Jhobean]

If I activate identity packet on the web client, I get this When I choose the server.

13:08:DEBUG:3:client->server Packet len=3 id=0xa0 [2025/09/08 13:08:19]
        0  1  2  3  4  5  6  7   8  9  A  B  C  D  E  F
       -- -- -- -- -- -- -- --  -- -- -- -- -- -- -- --
0000   a0 00 01                                          ...

13:08:DEBUG:Parsing next packet into the received packet data stream (previous dump).
13:08:DEBUG:3:sub-packet client->server Packet len=3 id=0xa0 [2025/09/08 13:08:19]
        0  1  2  3  4  5  6  7   8  9  A  B  C  D  E  F
       -- -- -- -- -- -- -- --  -- -- -- -- -- -- -- --
0000   a0 00 01                                          ...

13:08:DEBUG:3:Login_Relay to server 198.16.189.178 with AuthId 894747939
13:08:DEBUG:3:server->client Packet len=11 id=0x8c [2025/09/08 13:08:19]
        0  1  2  3  4  5  6  7   8  9  A  B  C  D  E  F
       -- -- -- -- -- -- -- --  -- -- -- -- -- -- -- --
0000   8c c6 10 bd b2 0a 23 35  54 c5 23                  ......#5T.#

13:08:DEBUG:3:Client being closed by read-thread
13:08:DEBUG:3:Client being closed by write-thread
13:08:DEBUG:3:Client is being cleared since marked to close.
13:08:DEBUG:3:Clearing client state.
13:08:3:Client disconnected [Total:0]. Account: 'dixonze'. IP='XXX.234.149.72'.
13:08:DEBUG:Receiving new connection.
13:08:DEBUG:Retrieving IP history for 'XXX.234.149.72'.
13:08:DEBUG:Incoming connection from 'XXX.234.149.72' [IP history: blocked=0, ttl=300, pings=2, connecting=0, connected=0].
13:08:DEBUG:4:Allocated slot for client (socket 4248).
13:08:DEBUG:4:Clearing client state.
13:08:DEBUG:4:Initializing client
13:08:4:Client connected [Total:1]. IP='xxx.234.149.72'. (Connecting/Connected: 1/1).
13:08:DEBUG:4:Opening network state
13:08:DEBUG:4:Determining async mode. Current: 0
13:08:DEBUG:4:State initialised, registering client instance.
13:08:DEBUG:4:Selecting a thread to assign to.
13:08:DEBUG:Searching for a suitable thread to handle a new client..
13:08:DEBUG:Selected thread #0.
13:08:DEBUG:4:Client successfully initialised.
13:08:DEBUG:4:Client connected with a seed length of 4 ([0]=0x35)
13:08:DEBUG:4:Receiving old client login handshake.
13:08:DEBUG:4:Client connected with a seed of 0x3554c523 (new handshake=0, version=0).
13:08:WARNING:4:Client connected with a seed length of 149 exceeding max length limit of 127, disconnecting.

[Jhobean]

here What I get if web identity is DESACTIVATE

13:12:DEBUG:9:client->server Packet len=3 id=0xa0 [2025/09/08 13:12:53]
        0  1  2  3  4  5  6  7   8  9  A  B  C  D  E  F
       -- -- -- -- -- -- -- --  -- -- -- -- -- -- -- --
0000   a0 00 01                                          ...

13:12:DEBUG:Parsing next packet into the received packet data stream (previous dump).
13:12:DEBUG:9:sub-packet client->server Packet len=3 id=0xa0 [2025/09/08 13:12:53]
        0  1  2  3  4  5  6  7   8  9  A  B  C  D  E  F
       -- -- -- -- -- -- -- --  -- -- -- -- -- -- -- --
0000   a0 00 01                                          ...

13:12:DEBUG:9:Login_Relay to server 198.16.189.178 with AuthId 894747939
13:12:DEBUG:9:server->client Packet len=11 id=0x8c [2025/09/08 13:12:53]
        0  1  2  3  4  5  6  7   8  9  A  B  C  D  E  F
       -- -- -- -- -- -- -- --  -- -- -- -- -- -- -- --
0000   8c c6 10 bd b2 0a 23 35  54 c5 23                  ......#5T.#

13:12:DEBUG:9:Client being closed by read-thread
13:12:DEBUG:9:Client being closed by write-thread
13:12:DEBUG:9:Client is being cleared since marked to close.
13:12:DEBUG:9:Clearing client state.
13:12:9:Client disconnected [Total:0]. Account: 'dixonze'. IP='xxx.234.149.72'.
13:12:DEBUG:Receiving new connection.
13:12:DEBUG:Retrieving IP history for 'xxx.234.149.72'.
13:12:DEBUG:Incoming connection from 'xxx.234.149.72' [IP history: blocked=0, ttl=300, pings=5, connecting=0, connected=0].
13:12:DEBUG:a:Allocated slot for client (socket 4200).
13:12:DEBUG:a:Clearing client state.
13:12:DEBUG:a:Initializing client
13:12:a:Client connected [Total:1]. IP='xxx.234.149.72'. (Connecting/Connected: 1/1).
13:12:DEBUG:a:Opening network state
13:12:DEBUG:a:Determining async mode. Current: 0
13:12:DEBUG:a:State initialised, registering client instance.
13:12:DEBUG:a:Selecting a thread to assign to.
13:12:DEBUG:Searching for a suitable thread to handle a new client..
13:12:DEBUG:Selected thread #0.
13:12:DEBUG:a:Client successfully initialised.
13:12:DEBUG:a:Client connected with a seed length of 4 ([0]=0x35)
13:12:DEBUG:a:Receiving old client login handshake.
13:12:DEBUG:a:Client connected with a seed of 0x3554c523 (new handshake=0, version=0).
13:12:a:Login for account 'dixonze'. IP='205.234.149.72'. ConnectionType: CharList/Game.
13:12:DEBUG:a:xProcessClientSetup for dixonze, with AuthId 894747939 and CliVersion 0 / CliVersionReported 70010621

[mtwango]

Simplified workflow:

09:00:DEBUG:0:client->server Packet len=62 id=0x80 [2025/09/09 09:00:25]
09:00:DEBUG:0:server->client Packet len=46 id=0xa8 [2025/09/09 09:00:25]
09:00:DEBUG:0:client->server Packet len=149 id=0xa4 [2025/09/09 09:00:25]
09:00:DEBUG:0:client->server Packet len=3 id=0xa0 [2025/09/09 09:00:26]
09:00:DEBUG:0:Login_Relay to SERVER_IP
09:00:DEBUG:0:Login_Relay to server SERVER_IP with AuthId AUTH_ID
09:00:DEBUG:0:server->client Packet len=11 id=0x8c [2025/09/09 09:00:26]
09:00:0:Client disconnected
09:00:1:Client connected
09:00:DEBUG:1:client->server Packet len=149 id=0xa4 [2025/09/09 09:00:27]
--------------- (doesn't get to the lines bellow)
09:00:DEBUG:3:xProcessClientSetup
09:00:DEBUG:3:client->server Packet len=65 id=0x91 [2025/09/09 09:00:40]

The issue here is, that packet 0xa4 is sent after reconnection. First occurence of this packet is ok and goes to PacketSystemInfo::onReceive as it should.
Second occurence however fails, since it it received in wrong stage.

I was able to implement WebIdentity config variable: mtwango@65653ab
And workaround this stage, but its definitely a workaround:

• increase limit for packet size in pre-game stage: mtwango@b91dab3
• skip second occurence of this packet: mtwango@7f23659

I've prepared example (not building atm) how to handle validation: mtwango@8c8c977

The packet would need to modify net.m_peerAddress with data received from identity packet.

Packet structure is as follows:

149 = size
-----------------
  1 = packet Id
  6 = clientType ("CUOWEB")
  1 = version (1)
  4 = timestamp
137 = variable data (see bellow)

Variable data:
Variable data contains the following (metioned in here: https://github.com/ClassicUO/packets/blob/main/README.md):

• secret (for example pcbflwy4ex9fjz5p, defined in shard management under Customization -> Packets)
• userId (01K3TCFWTJE0P1CMTS8GNUDX1N, for nonanonymous accounts, you can find this ID in shard management under Security tab)
• connectingIp (looks like IPv4: 250.56.23.226. During my testing, it was different from my real IP, so I can say for sure what IP this is, other than some Bogon address)
• externalAuthProvider (should be always discord)
• externalAuthUsername (discord user name: mtwango#0)
• externalAuthId (this is your discord ID: 557237288862482443)
• role (shardowner, for nonanonymous accounts, this is probably specified in shard management under Security tab)

These data have variable length and are delimited by null byte (00). If the variable data are shorter than 137 characters, rest of the packet is filled with null bytes.

Of these variable data I think only secret and connectingIp is needed. Secret for verification and IP to modify current IP for logged player.