3 ms·
Or that the session ticket verification flow needs connectivity between the game server and Valve's (apparently very slow at times) auth server. Presumably a f
by BHSPitMonkey 3y ago
Or that the session ticket verification flow needs connectivity between the game server and Valve's (apparently very slow at times) auth server.
Presumably a faster and more robust solution would be for the Steam client to obtain (and hang onto) a signed token (from Valve) with a lifetime of a few hours, and whenever you connect to a game server that token is sent over where it can be validated locally against a public cert issued by Valve (that comes distributed with the game server contents).
- charcircuit 3y agoThe problem with that approach is that a malicous server can replay tokens to impersonate players on another server.
- GranPC 3y agoThis exact thing happened about a decade ago, when someone released a tool called Serenity that allowed you to spoof your SteamID using recorded tickets. It was especially chaotic for the Garry's Mod community, since most servers have admin tools gated behind SteamID checks.
- adobrawy 3y agoTo protect against replay of the token associated with the certificate, simply challenge the client to sign the value specified by the server eg. random value+server ID. However, it smells like self-made crypto.