OpenID authentication through Steam

Question

I've spent the better part of the day trying to figure out how OpenID works. My goal is to set up a simple site where, upon clicking a login button, users are taken to a Steam login-page, where they are prompted for username and password. After successfully logging in, the user is redirected to a page on my domain, where I collect the query string parameters. They look like this:

{  
    "openid.ns": "http://specs.openid.net/auth/2.0",
    "openid.mode": "id_res",
    "openid.op_endpoint": "https://steamcommunity.com/openid/login",
    "openid.claimed_id": "https://steamcommunity.com/openid/id/7656119[0000000000]",
    "openid.identity": "https://steamcommunity.com/openid/id/7656119[0000000000]",
    "openid.return_to": "http://127.0.0.1:8000/resolve",
    "openid.response_nonce": "2018-12-01T14:49:46Z30hhn2/[someTEXTendingIN=]",
    "openid.assoc_handle": "1234567890",
    "openid.signed": "signed,op_endpoint,claimed_id,identity,return_to,response_nonce,assoc_handle",
    "openid.sig": "[someTEXTandNUMBERSendingIN=]"
}

What I am unable to solve though, is the actual authentication issue. I'm not sure what to do with this data. I want to have my own database where I store more information about the user, such as friends, messages, currency etc. For this, it is very important that I can verify that someone didn't just take this request body, change their ID for another and in that way access their account.

I'm pretty sure these are the relevant pieces of documentation, but it still isn't clear to me. How am I supposed to authenticate the user with this data?

I've omitted some values in this post that I fear could be bad to share. These placeholders have been outlined with brackets []. Also, that assoc_handle is really 1234567890, which kind of puts me off, since according to the OpenID documentation, it is used for determining the signature.

To be clear: this page where credentials are collected is not run by me, but is the official OpenID sign-in page for Steam. Steam is a gaming platform. https://steamcommunity.com/dev/ for reference.

defectivepixel defectivepixel · Accepted Answer · 2018-12-01T15:17:10

For Steam authentication in nodejs you can use Passport.

Passport is an authentication library that works best with Express-based web application.

There is a steam-strategy that can handle your steam authentication.

Check passport here

And this is the Repository for Steam strategy. There is an example folder that you can see how to setup your Steam authentication.

OpenID authentication through Steam

1 Answers