I am working on a personal program using node.js that uses authentication for Steam app specifically. The login reads the username and password from an external .txt file and it works using array positioning, split by a ‘:’ (colon). Now this is where I need help. With some accounts Steam uses a two factor code that is randomly generated by time on a mobile app or by email. At this time, I have my program so it checks to see if the account has the authentication code enabled and if it does I have it prompt to manually put in the appropriate two factor code. I know that there is a way to incorporate my program to pull this authentication code and put it in without having the user to do so manually but I don’t know where to start.
Problem: I want the program to pull a randomly generated code and automatically set it in without having to do anything manual.
Code is as follows:
else if (eresult === Steam.EResult.AccountLoginDeniedNeedTwoFactor)
{
login.two_factor_code = readline.question(`[${param[0]}] Mobile auth code: `);
client.disconnect();
client.connect();
}
else if (eresult === Steam.EResult.AccountLogonDenied)
{
login.auth_code = readline.question(`[${param[0]}] Steam Guard code: `);
client.disconnect();
client.connect();
}
Thank you.
Two factor authentication (2FA) is a principle where you're authorized to a resource by two separate factors. 1. something you know (login/pass) 2. something you have (a phone with a 2FA app installed, like Google Authenticator, Authy, also I think there's an app for this made by Steam).
If I understood you correctly - you want to store passwords and 2FA details in your app. Probably there's a technical way to do it, but I would not use such an app. This is a big security no-no. Better to ask users of your app to provide login/password each time, and if Steam API asks for second factor - ask the users for it.
As I seen most APIs - you could probably get a special token so the user don't have to login and provide the code each time without storing the password etc. Dig in the docs - you'll find it. (Unless you don't use any official Steam API, but it looks form the code that you probably do)
Related
I've spent the better part of the day trying to figure out how OpenID works. My goal is to set up a simple site where, upon clicking a login button, users are taken to a Steam login-page, where they are prompted for username and password. After successfully logging in, the user is redirected to a page on my domain, where I collect the query string parameters. They look like this:
{
"openid.ns": "http://specs.openid.net/auth/2.0",
"openid.mode": "id_res",
"openid.op_endpoint": "https://steamcommunity.com/openid/login",
"openid.claimed_id": "https://steamcommunity.com/openid/id/7656119[0000000000]",
"openid.identity": "https://steamcommunity.com/openid/id/7656119[0000000000]",
"openid.return_to": "http://127.0.0.1:8000/resolve",
"openid.response_nonce": "2018-12-01T14:49:46Z30hhn2/[someTEXTendingIN=]",
"openid.assoc_handle": "1234567890",
"openid.signed": "signed,op_endpoint,claimed_id,identity,return_to,response_nonce,assoc_handle",
"openid.sig": "[someTEXTandNUMBERSendingIN=]"
}
What I am unable to solve though, is the actual authentication issue. I'm not sure what to do with this data. I want to have my own database where I store more information about the user, such as friends, messages, currency etc. For this, it is very important that I can verify that someone didn't just take this request body, change their ID for another and in that way access their account.
I'm pretty sure these are the relevant pieces of documentation, but it still isn't clear to me. How am I supposed to authenticate the user with this data?
I've omitted some values in this post that I fear could be bad to share. These placeholders have been outlined with brackets []. Also, that assoc_handle is really 1234567890, which kind of puts me off, since according to the OpenID documentation, it is used for determining the signature.
To be clear: this page where credentials are collected is not run by me, but is the official OpenID sign-in page for Steam. Steam is a gaming platform. https://steamcommunity.com/dev/ for reference.
For Steam authentication in nodejs you can use Passport.
Passport is an authentication library that works best with Express-based web application.
There is a steam-strategy that can handle your steam authentication.
Check passport here
And this is the Repository for Steam strategy. There is an example folder that you can see how to setup your Steam authentication.
I'm very new to python scripting and anything online in general, but I wanted to start somewhere interesting so I came up with a goal to write a simple desktop .py file that everytime I run just simply posts 'Hello World' to my facebook wall under my name.
In the end, I managed by just hardcoding (to my knowledge) a User Access Token and using the facebook graph under that token
facebookGraph = facebook.GraphAPI(access_token="qwertyuiop")
fb_response = facebookGraph.put_object("me", "feed", message="Hello World")
now the docs say that the User Token's lifetime is quite short and I don't really like the idea of having to manually going in and copying it into my program (even if its at every 2 hours or 2 months) so I made a second attempt by instead fetching an App Token to which I enabled every permission to access my account
def FetchAppAccessToken(app_id, app_secret):
headers = {'grant_type': 'client_credentials', 'client_id': app_id, 'client_secret': app_secret}
response = requests.post('https://graph.facebook.com/oauth/access_token?', params = headers)
logging.debug(response.text)
return response
#then.. get the right substring within response and use the graph as before
but I'm always met with
facebook.GraphAPIError: An active access token must be used to query information about the current user.
I thought that maybe using the User Token was the way to go, but after several hours of trial and error including trying to get the User Token by supplying an email and password, I read that it was not possible at all without user interaction. So going back to App Tokens and more reading. I came across using PHP within Python or creating a Login Flow with OAuth/OAuth2 (which I have neither experience with) to retrieve a token that I can use, but I'm starting to feel like I'm getting off track on what I'm supposed to be using.
Is there a simpler way like providing email and password to a file that as long as its in my desktop would accomplish that task?
Also, I'd like to avoid opening any browser and click simulations to do it (if its even possible that way).
Not sure if this is the most efficient answer, but I managed by using App credentials to authenticate my login, but instead of passing it through requests, I had it go through a WebWidget to emulate a browser in which the URL would include the code or token, close the window after retrieving the value and use it to create the facebook graph and run it like normal.
facebookGraph = facebook.GraphAPI(access_token=accessToken["access_token"], version=2.7)
facebookGraph.put_object(parent_object='me', connection_name='feed', message='Hello, world')
Unfortunately it does have to go through a pseudo browser.
I haven't tried this yet but,
On the other hand, if theres a user already logged in, you could check cookies if a user is already logged in and exchange the code for an access token and just do a browser login if theres none. This way the webwidget doesnt need to popup every time the program is run.
I'm working in a React application that basically resets the password to non authenticated users. The problem is, in order to do that with Ajax, I'm exposing the service url (which is not secure, and I can't work over that, since that part of the project belongs to other company).
My idea was (I've never done this before so I'm not sure this is the way to go) to create some sort of REST service in the middle that "hides" the real service from the user, so I call it and "he" calls the actual server, giving me the data I need.
But, I need to secure this new service so only my app can use it, right?. If this is a good way to do it, how can I implement this with non authenticated users?. If don't, what can I do to solve this problem?
I'm open to any ideas, I was planning to use Node.js but I have zero experience with this particular matter.
Any help is very welcome, thanks in advance!
If you cant make any changes in the existing service and it lies in non secure env, then your thinking is correct. Its better to create a REST service which is called from UI, and that REST service in turn should call your existing service.
Now, if you dont have any feature to authenticate user, then I'm not sure how you can make that REST service secure. Even if you create a REST service, it wont solve your purpose if you dont have any means in place to authenticate user. Even that REST service will be exposed and wont solve your purpose.
If you have a functionality to authenticate user, like creating a session or capturing some details initially before you call this service or a login screen etc, which will serve as a way to verify user before you access other services, then you have a solution.
If you need to authenticate the users, the most current practice is to use e-mails - assuming that only the user has access to his email. (this is also the cheapest one).
When you generate the url is when you need to be careful. Basically, you need to ensure that it is unique, not publicly published, and associated with a particular user - for a short amount of time. The common and most straight-forward way to do it is by appending tokens to the url. Now, there are several crypto requirements connected to the token generation, I would advice not creating your own code for this functionally. As an example of one time use token, we can check https://www.rfc-editor.org/rfc/rfc6750.
However, as you tagged Liferay on this thread, you could consider using the UserLocalService to generate the emails.
Or get inspiration from this code for URL generation:
Date expirationDate = null;
if ((passwordPolicy != null) &&
(passwordPolicy.getResetTicketMaxAge() > 0)) {
expirationDate = new Date(
System.currentTimeMillis() +
(passwordPolicy.getResetTicketMaxAge() * 1000));
}
Ticket ticket = ticketLocalService.addDistinctTicket(
companyId, User.class.getName(), user.getUserId(),
TicketConstants.TYPE_PASSWORD, null, expirationDate,
serviceContext);
StringBundler sb = new StringBundler(6);
sb.append(serviceContext.getPortalURL());
sb.append(serviceContext.getPathMain());
sb.append("/portal/update_password?p_l_id=");
sb.append(serviceContext.getPlid());
sb.append("&ticketKey=");
sb.append(ticket.getKey());
passwordResetURL = sb.toString();
Is there any solutions to understand from my MVC application that user already signed in into Office365?
Currently I'm using the code below to authenticate to my MVC application:
var authContext = new AuthenticationContext("https://login.windows.net/MyTenantId");
var authResult = authContext.AcquireToken("https://MyTenantId/AppWebApi",
"ClientId", new Uri("redirect uri"));
By this code user is suggested to enter his credentials to sign in into Azure Active Directory. And it works fine, but it doesn't see that user already signed in to Office365 and work with Word, for example.
The code you wrote there does not work in a web application. It might work while you are hitting localhost, but as soon as you deploy your web app to an actual server it will not be able to pop out the dialog. Did you get that code form some sample? Could you point me to that? This is already the 2nd question containing the same error in 2 days, after 2 or 3 years of the library being available.
Back to your question.
How did the user sign in your application? If you would have used AAD to handle web sign on, like in this sample, you would know upfront (and the answer would be always 'yes', just for the fact that he/she'd need to in order to have access to your application).
If you are using a different sign on system, there are techniques for finding out if a user is signed in without showing any UX, but they are pretty advanced (requiring the use of a hidden frame and special request parameters) and before digging deeper in that I think it would be useful to know what your scenario requires. Do you need a token, or do you simply need to know if the user is already signed in in O365?
I'm in the process of using the facebook javascript sdk to provide user login functionality for a website.
What I'd like to do is simply take the logged in user's unique facebook id and then put/fetch data to/from a mysql database using the id to determine what data is available to said user.
However I don't really feel like this is very secure. Whilst I'm not storing anything sensitive like credit-card details etc, I'd obviously prefer it to be as secure as practically possible.
My fear is that with javascript being what is it, someone could fake the facebook id and just pull whatever they wanted.
I'm aware that the php sdk would provide a solid solution to this problem, but i like the javascript one mainly because it's easy to use and I have the basis of it set up (I admit it, I'm lazy).
So, my questions are:
Would this set up be as insecure as I feel it might be?
Is there anything I can do to improve the security of such a system, other than switching to the php sdk?
Thanks!
Facebook Ids are pretty hard to make up (at most a user will only know their own). Depending on what you store in the database (which will not be anything that the user cannot get on their own, unless you ask for extended permissions)
If you are worried about a user trying to get information from the database, add an access token or signed request to each row and us that and facebook id to get data. That will greatly increase security.
EDIT
There are few occasions where you get a signed request from a user:
* A signed_request is passed to Apps on Facebook.com when they are loaded into the Facebook environment
* A signed_request is passed to any app that has registered an Deauthorized Callback in the Developer App whenever a given user removes the app using the App Dashboard
* A signed_request is passed to apps that use the Registration Plugin whenever a user successfully registers with their app
Signed requests will contain a user id only if the use has accepted permissions though, and are not passed again if the user enters the application, and accepts permissions (meaning that the signed request would not contain the ID). Because of this saving an access token may be a better idea. Here is more on the signed request
Also the signed request is in the url (param = "signed_request"). I always parse it through c# but I am sure you can at least get one through javascript
It's pretty easy to spoof the origin using curl. I'd imagine Facebook has another mecanism in place to make this possible. If you inspect their code, it appears that they generate an iframe and pass requests through. If I had to guess, they have setup the requests to only be made from the Facebook domain, and ensure that the iframe can only be embedded in a page that has a white listed domain.