Steam OpenID not working!

[Adaś Miauczyński]

Hello, I using Steam OpenID to login in my some website, today nobody can login, because steamid64 isn't returned.

<?php
class SteamSignIn {
	const STEAM_LOGIN = 'https://steamcommunity.com/openid/login';
	public static function genUrl($returnTo = false, $useAmp = true) {
		$returnTo = (!$returnTo) ? (!empty($_SERVER['HTTPS']) ? 'https' : 'http').':/MYSITE.com' : $returnTo;
		$params = array(
			'openid.ns'			=> 'http://specs.openid.net/auth/2.0',
			'openid.mode'		=> 'checkid_setup',
			'openid.return_to'	=> $returnTo,
			'openid.realm'		=> (!empty($_SERVER['HTTPS']) ? 'https' : 'http').':/MYSITE.com/',
			'openid.identity'	=> 'http://specs.openid.net/auth/2.0/identifier_select',
			'openid.claimed_id'	=> 'http://specs.openid.net/auth/2.0/identifier_select',
		);
		$sep = ($useAmp) ? '&amp;' : '&';
		return self::STEAM_LOGIN . '?' . http_build_query($params, '', $sep);
	}
	public static function validate() {
		$params = array(
			'openid.assoc_handle'	=> $_GET['openid_assoc_handle'],
			'openid.signed'			=> $_GET['openid_signed'],
			'openid.sig'			=> $_GET['openid_sig'],
			'openid.ns'				=> 'http://specs.openid.net/auth/2.0',
		);
		$signed = explode(',', $_GET['openid_signed']);
		foreach($signed as $item)
		{
			$val = $_GET['openid_' . str_replace('.', '_', $item)];
			$params['openid.' . $item] = get_magic_quotes_gpc() ? stripslashes($val) : $val; 
		}
		$params['openid.mode'] = 'check_authentication';
		$data =  http_build_query($params);
		$context = stream_context_create(array(
			'http' => array(
				'method'  => 'POST',
				'header'  => 
					"Accept-language: en\r\n".
					"Content-type: application/x-www-form-urlencoded\r\n" .
					"Content-Length: " . strlen($data) . "\r\n",
				'content' => $data,
			),
		));
		$result = file_get_contents(self::STEAM_LOGIN, false, $context);
		preg_match("#^http://steamcommunity.com/openid/id/([0-9]{17,25})#", $_GET['openid_claimed_id'], $matches);
		$steamID64 = is_numeric($matches[1]) ? $matches[1] : 0;
		return preg_match("#is_valid\s*:\s*true#i", $result) == 1 ? $steamID64 : '';
	}
}
$steamid64 = SteamSignIn::validate();
echo $steamid64; // here showed SteamID64
?>

I've been using this code for several years, it has always been working, today it doesn't work. What's the problem?

[Forcen]

Yeah, they changed the site to https yesterday. Change that last url to https and it might work?

[Adaś Miauczyński]

Ohh, thanks. Why Steam didn't inform anyone about this? I don't follow the forum.

[Forcen]

Ursprünglich geschrieben von |Agromex| WooQash:

Ohh, thanks. Why Steam didn't inform anyone about this? I don't follow the forum.

Idno, how would you expect them to inform you? Is there a mailing list or something?
I would guess they didn't think that this would cause problems.

[cSg|mc-Hotsauce]

This type of update is never announced.

https://steamcommunity.com/groups/SteamClientBeta/discussions/1/1696043806558039623/#c1696043806558423700

[altned888]

Hello

I'd added SSL to my server and enabled https but still auth openid is not working. I'd used the free ssl certificate from sslforfree.com could that be the issue that the free certificate authority is not acceptable for their security standards?

[Forcen]

Ursprünglich geschrieben von altned888:

Hello

I'd added SSL to my server and enabled https but still auth openid is not working. I'd used the free ssl certificate from sslforfree.com could that be the issue that the free certificate authority is not acceptable for their security standards?

I'm not sure that you need SSL for your site for this to work properly, the problem is probably elsewhere. In the example above the URL to steamcommunity.com pointed to http, does yours do that to?

Still, no reason to not use HTTPS these days so I say keep it, letsencrypt.org is great and it looks like that thing you linked uses that. But maybe look into using letsencrypt directly just in case if that site is bad somehow. Maybe this one is better: https://gethttpsforfree.com/
More info why you should use ssl: doesmysiteneedhttps.com

[altned888]

Ooops! I misunderstood it completely but for good I guess.

I did fixed it and its working, am glad that you responded quickly.

[German]

Guys, help pls to sort out with OpenID steam:

1. User click to login with steam
   
2. user redirected to something like this:
   https://steamcommunity.com/openid/login
   ?openid.ns=http://specs.openid.net/auth/2.0
   &openid.mode=checkid_setup
   &openid.return_to=https://site.ru/loginok
   &openid.realm=https://site.ru
   &openid.claimed_id=http://specs.openid.net/auth/2.0/identifier_select
   &openid.identity=http://specs.openid.net/auth/2.0/identifier_select
   
3. After autorization user come back to openid.return_to=https://site.ru/loginok

All right? Were is accessToken and steamid?
I yet have steam web api key, but dont know how to create OpenID on site.

PS i used vanila asp.net, do not know much php

[Adaś Miauczyński]

How I can get a inform why I have 403 error WITHOUT REASON. I never abused it and I don't know why I have 403...