search

DoctorMcKay / node-steam-session

Node.js module for authenticating with the Steam auth server. Allows for generating refresh tokens and web auth cookies for use with steam-user and other packages.
https://www.npmjs.com/package/steam-session
MIT License
112 stars 20 forks source link

fix creation webcookeis for `EAuthTokenPlatformType.WebBrowser` #37

Closed Sadzurami closed 7 months ago

Sadzurami commented 7 months ago

Valve (again) change web authorization. Now we have different cookies for all subdomains.

Eg. cookies from steamcommunity.com now we can't use for store.steampowered.com, etc. New access token audience:

store.steampowered.com

"aud": [
    "web:store"
]

steamcommunity.com

"aud": [
    "web:community"
]

Only fair for creation cookies with EAuthTokenPlatformType.WebBrowser. EAuthTokenPlatformType.SteamClient and EAuthTokenPlatformType.MobileApp still creates cookies with common audience: 

"aud": [
    "web",
    "mobile"
]

So, will be better to return full cookies strings with Domain attribute. Will require some changes on client side, but popular packages that maintain cookies (CookieJar) automatically can use full and short variants.

DoctorMcKay commented 7 months ago

Dammit, Valve.

Are you ready for this to be merged?

Sadzurami commented 7 months ago

Dammit, Valve.

Are you ready for this to be merged?

ready

DoctorMcKay commented 7 months ago

getWebCookies is actually returning an array of arrays, will fix this.

DoctorMcKay commented 7 months ago

Technically, the access_token returned in PollAuthSessionResponse is still valid for "web", but Valve has already removed that token once before so probably best not to rely on it.

Sadzurami commented 7 months ago

getWebCookies is actually returning an array of arrays, will fix this.

Sorry for that and thanks for quick fix

Sadzurami commented 7 months ago

in 1.7.2 release message there is typo (with ; Domain=steamcommunity.com appended in the cookie string)

may be misunderstanding, better change to smth like (with ; Domain=<some-steam-domain> appended in the cookie string)