five-on-it / apps/client/electron/steam-openid
apps/client/electron/steam-openid
Signing in on Steam's own page in a window of the desktop app's, when Steam is not running (no ticket, steam.ts): the window opens on the platform's /auth/steam/openid/start?return=<address> (apps/api/src/steam-routes.ts), Steam's page (or the fake Steam's) signs the player in, and the platform sends the window back to the address with a one-time code. That address is one of the platform's own, which its return check takes (its API's: openIdReturn), and the window never loads it: the main process catches the redirect to it, takes the code (or the error) from it and closes the window, and the page exchanges the code for a session (POST /auth/steam/exchange). The window is the plain web's: sandboxed, no preload, a session of its own (persist:steam, so Steam remembers the player next time), no window opening from it.