OnClientAuth
OnClientAuth is called when a connecting client sends its user information packet, before the server checks whether the client's branch is allowed and before the player is fully connected.
void OnClientAuth(Network.Connection connection)Parameters
| Parameter | Type | Description |
|---|---|---|
connection | Network.Connection | The Network.Connection of the client that has just sent its user information packet. Use connection.userid for the Steam ID and connection.connection to handle very early disconnects. |
Return value
The return value is ignored. The original OnGiveUserInformation code runs regardless of what the hook returns, so returning false or any other value will not prevent the branch check or the connection from proceeding.
How it works
The hook fires from ServerMgr.OnGiveUserInformation, after the server has read the packet's branch string and before IsClientBranchAllowed runs its kick check. This makes it one of the earliest points where a plugin sees a connecting client, earlier than OnPlayerConnected and before any BasePlayer entity exists for that connection.
The only parameter is the Network.Connection. It carries the Steam ID (connection.userid) and the raw connection.connection string, and it can be used to reject or record the arriving client. Because the return value is ignored, you cannot block the connection by returning anything; if you want to deny access, disconnect it yourself via the connection.
Declaring the parameter as Network.Connection is required; there is no more specific type to narrow to. Null-check connection and its nested members, and keep the hook cheap: it runs for every joining client, including bots and reconnects, and it must not throw, since an exception here happens outside the normal player lifecycle.
Example plugin: Record join attempts and disconnect clients on a blocklist
using System.Linq;
using System;
using System.Collections.Generic;
using Newtonsoft.Json;
using Oxide.Core;
using UnityEngine;
namespace Oxide.Plugins
{
[Info("Client Auth Guard", "RustPluginGenerator", "1.0.0")]
[Description("Disconnects blocked Steam IDs at client auth and tracks join attempts")]
public class ClientAuthGuard : RustPlugin
{
private const string PermManage = "clientauthguard.manage";
private PluginConfig config;
private JoinData data;
private class PluginConfig
{
[JsonProperty("Blocked Steam IDs")]
public List<string> BlockedIds = new List<string>();
}
private class JoinData
{
[JsonProperty("Join attempts per Steam ID")]
public Dictionary<string, int> Attempts = new Dictionary<string, int>();
}
protected override void LoadDefaultConfig() => config = new PluginConfig();
protected override void LoadConfig()
{
base.LoadConfig();
try
{
config = Config.ReadObject<PluginConfig>();
if (config == null) throw new Exception();
}
catch
{
PrintWarning("Configuration file is invalid, using defaults");
LoadDefaultConfig();
}
SaveConfig();
}
protected override void SaveConfig() => Config.WriteObject(config);
protected override void LoadDefaultMessages()
{
lang.RegisterMessages(new Dictionary<string, string>
{
["Blocked"] = "Your Steam ID ({0}) is blocked from this server.",
["Attempts"] = "Steam ID {0} has attempted to join {1} time(s).",
["Added"] = "Added {0} to the blocklist.",
["Removed"] = "Removed {0} from the blocklist."
}, this);
}
private string Msg(string key, string userId = null, params object[] args) =>
string.Format(lang.GetMessage(key, this, userId), args);
private void Init()
{
permission.RegisterPermission(PermManage, this);
data = Interface.Oxide.DataFileSystem.ReadObject<JoinData>(Name) ?? new JoinData();
}
private void Unload()
{
if (data != null)
Interface.Oxide.DataFileSystem.WriteObject(Name, data);
}
private void OnClientAuth(Network.Connection connection)
{
if (connection == null) return;
string userId = connection.userid.ToString();
if (string.IsNullOrEmpty(userId)) return;
data.Attempts.TryGetValue(userId, out int count);
data.Attempts[userId] = count + 1;
if (config.BlockedIds != null && config.BlockedIds.Contains(userId))
{
PrintWarning(Msg("Blocked", null, userId));
timer.Once(0.5f, () =>
{
BasePlayer p = BasePlayer.FindByID(connection.userid);
if (p != null && p.IsConnected)
p.Kick("Your Steam ID is blocked from this server.");
});
}
}
[ChatCommand("blockid")]
private void CmdBlock(BasePlayer player, string command, string[] args)
{
if (player == null || !player.IsAdmin && !permission.UserHasPermission(player.UserIDString, PermManage))
{
SendReply(player, "No permission.");
return;
}
if (args == null || args.Length == 0)
{
SendReply(player, "/blockid <steamid> [remove]");
return;
}
string target = args[0];
if (args.Length > 1 && args[1] == "remove")
{
config.BlockedIds.Remove(target);
SendReply(player, Msg("Removed", player.UserIDString, target));
}
else
{
if (!config.BlockedIds.Contains(target))
config.BlockedIds.Add(target);
SendReply(player, Msg("Added", player.UserIDString, target));
}
SaveConfig();
}
}
}The plugin keeps a blocklist of Steam IDs in its config. In OnClientAuth it null-checks the connection, reads the Steam ID from connection.userid, increments a per-ID join attempt counter, and if the ID is on the blocklist it logs a warning and schedules a short timer that kicks the player if they are still connected. The counter is stored in oxide/data so admins can see reconnects before a player even spawns. Data is loaded in Init and written in Unload. Blocklist changes are made with the /blockid <steamid> [remove] chat command, which requires the clientauthguard.manage permission or admin status. Blocked, added, removed and attempt messages come from the language file; the usage and no-permission replies are hardcoded.
Common use cases
Early blocklist enforcement
Close the connection for known cheaters, ban evaders or unwanted Steam IDs before the player reaches the queue or spawns.
Connection auditing
Log every userid that sends user information so admins can match join attempts to reports of suspicious activity.
Reconnect tracking
Count how often a Steam ID connects during a wipe cycle to detect players repeatedly reconnecting.
Pitfalls
The return value is ignored
You cannot stop the connection by returning a value. To deny access you must disconnect the client through the connection object you receive.
No BasePlayer exists yet
The player entity is not created when this hook fires, so lookups by userid of
BasePlayeror sending chat messages will fail. Use the connection's userid only.Exceptions here can break joins
The hook runs inside the connection handshake. Wrap risky work and null-check everything, or a thrown exception may leave the client stuck in a half-connected state.
Build a plugin with OnClientAuth
Describe what should happen and get a compiled plugin that uses this hook.
Edit the prompt on the next screen. 2 free plugins a month, no card.
Last updated Oct 26, 2026. Found a mistake? Email support@rustplugingenerator.com.
Build a plugin with OnClientAuth
Generate