> verifies that the response has the steampowered.com domain and is https:// https:// But you're trading an easy solution (only use https:// https://) for seve

> verifies that the response has the steampowered.com domain and is https:// https:// But you're trading an easy solution (only use https:// https://) for several points of failures (validate potentially untrusted input all along the chain). > verifies that the response has the steampowered.com domain An attacker is going to look for any exploits on steampowered.com (open redirect, xss, etc.). So now your domain name check is insufficient, you also need to make sure that all of steampowered.com is secure (which, odds are, is managed by multiple teams).