Session expired, Sign back in?

[Nodens]

So, I quit my game I was playing, and I get a sign in window saying my session has expired and I have to sign back in to continue using steam, or exit steam. Then what I tried to sign back in a get an error. I did this three times before exiting. THEN I tried launching steam (in windows) and it would only boot up in the background and never bring up a sign in box.

This brings some pretty big implications on the functionality of steam as a service. One, this means if you internet shuts off, eventually you will be locked out of your account if you don't immediately switch to offline mode, seeing as you cannot go in to offline mode with out first logging in online. Second, The fact that they implemented a automatic time out for "sessions" in the first place makes no sense other than to gain query data, because it does nothing to increase security.

Either make it so we can log in to the account in offline mode after logging on the a device once, (we should be able to do this anyway), or get ride of this useless ♥♥♥♥. It just causing more user end problems.

[RiO]

steam.exe -noreactlogin

The session timeout is a consequence of the new React-based login experience.



You're in fact no longer logging in to the actual Steam client.

You're logging in on a web view using what looks to be shared logic with the website-version of Steam; and it seems Valve is migrating the auth information to the native client somehow. There are some indicators they are abusing the auto-login system that is available in the existing client, by directly pumping the new auth information into the VDF file in the Steam installation folder on disk before letting the client continue its start-up. Basically: the new sign-in is hacking their own credential storage infrastructure.

Long story short: what you get back are presumably auth tokens originally designed for a web-based session -- which would have much shorter expiration and refresh windows. Thus, you're now much more likely to suffer the condition where the client trips over an expired token that wasn't refreshed in time.

[Happeh]

I just experienced this and it was super annoying.

The computer is left permanently on with steam permanently open.

Now the smart guy above is telling me I am going to have to log in every single day because of this timeout stuff unless the shortcut is changed with the no react flag.

What a pain in the hiney!

[RiO]

That said; I've yet to be prompted for another 2FA token.
And 24hrs have definitely expired.

Maybe this has something to do with needing to actually refresh the auth tokens within the web context. I.e. you have to log back in within 24hrs, so the sign-in window can re-use the hack to migrate the refreshed web-based auth tokens into the native client again.

Basically; because this whole thing is a hack, the client itself can't refresh the tokens; only the original web-based context can? And thus it has to rely on you signing out and back in within 24hrs? I mean; it kind of sounds like it could be a thing from a techincal perspective?
And this would also be one of the typical facepalms Valve's developers would commit...

[Crashed]

Escrito originalmente por Nodens:

So, I quit my game I was playing, and I get a sign in window saying my session has expired and I have to sign back in to continue using steam, or exit steam. Then what I tried to sign back in a get an error. I did this three times before exiting. THEN I tried launching steam (in windows) and it would only boot up in the background and never bring up a sign in box.

This brings some pretty big implications on the functionality of steam as a service. One, this means if you internet shuts off, eventually you will be locked out of your account if you don't immediately switch to offline mode, seeing as you cannot go in to offline mode with out first logging in online. Second, The fact that they implemented a automatic time out for "sessions" in the first place makes no sense other than to gain query data, because it does nothing to increase security.

Either make it so we can log in to the account in offline mode after logging on the a device once, (we should be able to do this anyway), or get ride of this useless ♥♥♥♥. It just causing more user end problems.

Make sure you don't have multiple computers "in-game" at one time, because Steam only allows your Library to be used on one computer at a time.

[Magnus]

I just got this ♥♥♥♥ too after getting the new Steam Login. I pretty much only log in again when I reboot my computer as I don't have it save my credentials for security reasons.

This is going to get old fast if it keeps logging me out every day and I have to get a code from my email every ♥♥♥♥♥♥♥ time.

[Magnus]

Escrito originalmente por RiO:

steam.exe -noreactlogin

Thanks for this, the old login prompt is still there and works.

Also, why does the new login screen default to "Remember me" even after unchecking it on previous logins... fricking backwards security

Whoever green lighted this BS should be fired.

[Nodens]

Escrito originalmente por RiO:

steam.exe -noreactlogin

The session timeout is a consequence of the new React-based login experience.



You're in fact no longer logging in to the actual Steam client.

You're logging in on a web view using what looks to be shared logic with the website-version of Steam; and it seems Valve is migrating the auth information to the native client somehow. There are some indicators they are abusing the auto-login system that is available in the existing client, by directly pumping the new auth information into the VDF file in the Steam installation folder on disk before letting the client continue its start-up. Basically: the new sign-in is hacking their own credential storage infrastructure.

Long story short: what you get back are presumably auth tokens originally designed for a web-based session -- which would have much shorter expiration and refresh windows. Thus, you're now much more likely to suffer the condition where the client trips over an expired token that wasn't refreshed in time.

Is there a way to force no react on linux? I run a dual boot.

[RiO]

Escrito originalmente por Nodens:

Is there a way to force no react on linux? I run a dual boot.

I would assume Linux also understands CLI parameters.
You'll just have to figure out how to add them to whatever flavor of 'application links' your chosen desktop manager uses.