search

reu / omniauth-steam

Steam authentication strategy for OmniAuth
93 stars 38 forks source link

Getting invalid credentials if I try to login twice in the same session. #9

Closed Senjai closed 10 years ago

Senjai commented 10 years ago

Firstly, thanks for the strategy.

I'm getting an OmniAuth::InvalidCredentials error if I login once with steam, then try to do it a second time. To prevent this when I go to /auth/steam I have to click "Not you?" and relogin to prevent the error. Is this a thing you may have heard of? I'll try and get a sample app to reproduce it.

Senjai commented 10 years ago

Actually this seems to happen very erratically.

reu commented 10 years ago

Yes, I've seen this error before, but as you mentioned, it happens in very rare occasions, which makes me wonder if it is not the Steam servers going crazy...

Anyway, I would gladly accept a patch if you happen to find a definitive solution.

Senjai commented 10 years ago

@reu we did find a patch, havent submitted a pr for it. It goes all the way down to ruby-openid. It doesn't encode the signature properly. It puts spaces in what's supposed to be base64, which makes the response invalid as steam (in this case) can't handle the signature properly. Instead, there should be +'s, we did a quick hack to fix it here if your interested: https://github.com/freerunningtech/ruby-openid/commit/3fc5c34bd59b5a6ac4ce5aeba7b733e58fd1e83f

It happens seemingly randomly because not every bit of base64 is generated requiring +'s

reu commented 10 years ago

Whoa! Great @Senjai! Hope you can get this patch merged.

reu commented 10 years ago

Well, great work @Senjai! I am closing this for now.