search

SteamRE / SteamKit

SteamKit2 is a .NET library designed to interoperate with Valve's Steam network. It aims to provide a simple, yet extensible, interface to perform various actions on the network.
GNU Lesser General Public License v2.1
2.62k stars 497 forks source link

AuthenticateUser doesn't work on some accounts #613

Closed shravan2x closed 5 years ago

shravan2x commented 5 years ago

This doesn't have anything to do with SteamKit per-se, but I'm posting this issue here since it felt relevant. Feel free to mark this as a question.

So I've been using the ISteamUserAuth/AuthenticateUser endpoint to get web cookies similar to SteamBot and ASF. The issue is that on some of my accounts, this tokens returned by this endpoint only work the first time i.e. the cookies work once after initially logging on, but any further refreshes using WebAPIUserNonceCallback don't.

The funny part is that I've verified that the nonce used is the new one each time and each nonce works only once (as expected). The call to the AuthenticateUser endpoint succeeds with a 200 OK and it returns token and tokensecure - all normal. But these tokens don't work when used as cookies.

I've been investigating the actual requests made using Fiddler and NethookAnalyzer2 on the Steam client and it still doesn't make sense. It seems that most of the work done by AuthenticateUser is done on the backend and the actual tokens returned by it are the exact same every time. It just tells the server to continue treating those tokens as valid ones. The only time when the tokens actually change is on logon - for example, if the client disconnects and reconnects.

For some reason, the same authentication procedure used by ASF and SB don't work on some of my accounts, but work perfectly fine on others. All accounts work correctly on the actual Steam client.

I was wondering if someone here had any input w/ regards to this. I hope @JustArchi doesn't mind me tagging him.

JustArchi commented 5 years ago

I can't speak for your own code because I've never seen it, but I can speak for this part:

For some reason, the same authentication procedure used by ASF and SB don't work on some of my accounts, but work perfectly fine on others.

And what happens in ASF for those affected accounts? Can you post ASF log with your issue reproduced?

yaakov-h commented 5 years ago

Closing due to no further info in 6 months.