STEAM GROUP
Archi's SC Farm Archi-ASF
STEAM GROUP
Archi's SC Farm Archi-ASF
80,142
IN-GAME
467,853
ONLINE
Founded
29 October, 2015
Language
English
Arno 19 Sep, 2024 @ 9:37pm
Unable to log in via Web but ASF still authenticated
So, this is kind of out of left field and (as far as I can tell) not a problem with ASF, but I'm wondering if there's something I can do to troubleshoot.

I've got four accounts (my main and three low-traffic alts) with ASF active on all of them. Recently (about three days ago) I'm not able to log in (on the Steam Web site) to two of the alts; I'm getting a username/password error. I know I'm not typoing them because they're coming from a password manager. Not panicking yet, but I'm starting to get a teensy bit worried that they may have been compromised.

Anyway, the reason I'm posting here is I'm wondering if there's anything I can leverage in ASF, which is still logged in to all four accounts at the moment, to see if anything's wrong. Does ASF have any kind of functionality to, say, retrieve my account's recent login IP list?

I'm hesitant to try by exiting ASF and starting it back up, 'cause then if it doesn't work I'm worse off than I am now; at least as things are I've still got a valid, authenticated session with those two users that I can potentially do stuff with.
Originally posted by Archi:
In Bot.db file ASF saves crucial login properties, in particular BackingAccessToken. If you're not using ASF encryption (default PasswordFormat value in bot's config) then those properties are available to you in plaintext format. You can simply let ASF running and get its value from the DB file. Keep in mind access token is short-lived (IIRC around 24h) so you might need to wait for ASF to fetch new token for you and use that one when the old one is revoked.

When you extract the value, use https://jwt.io/ for verification that you extracted the correct thing. There should be no decoding errors or anything, you should get token properties on the right, nothing of interest for you but we use it as additional validation.

Once you confirm you got the right token, you can manually use it in steamLoginSecure value in the cookies. The value should be <yourSteamId64>||<BackingAccessToken>. The || should be encoded (%7C) in the value. Here is example for my account:

steamLoginSecure=76561198006963719%7C%7CeyAidHl(...)YjuOAw - My token starts with "eyA" and ends with "OAw". Of course I cut major part of it, yours will be longer.

You might also need to set sessionid cookie. This one is simple as you can use any value you like, assuming proper length (24) and alphabet (hex). Example below

sessionid=910fe127c0ca8ce7cd07d38d

If you set both of those values right, Steam might recognize it and present you logged-in session in the web browser. No guarantees though, as it has a lot of security mechanisms and it might also decide that you've done precisely what you did, stole those values from somewhere else (ASF), and it might invalidate them or refuse to use them because the origin (ASF, Steam client) does not match with yours (web browser). That'd require extra spoofing which is far beyond this already greatly out of the scope help.

Good luck :sgsmile:
< >
Showing 1-2 of 2 comments
A moderator of this forum has indicated that this post answers the original topic.
Archi 20 Sep, 2024 @ 12:24am 
In Bot.db file ASF saves crucial login properties, in particular BackingAccessToken. If you're not using ASF encryption (default PasswordFormat value in bot's config) then those properties are available to you in plaintext format. You can simply let ASF running and get its value from the DB file. Keep in mind access token is short-lived (IIRC around 24h) so you might need to wait for ASF to fetch new token for you and use that one when the old one is revoked.

When you extract the value, use https://jwt.io/ for verification that you extracted the correct thing. There should be no decoding errors or anything, you should get token properties on the right, nothing of interest for you but we use it as additional validation.

Once you confirm you got the right token, you can manually use it in steamLoginSecure value in the cookies. The value should be <yourSteamId64>||<BackingAccessToken>. The || should be encoded (%7C) in the value. Here is example for my account:

steamLoginSecure=76561198006963719%7C%7CeyAidHl(...)YjuOAw - My token starts with "eyA" and ends with "OAw". Of course I cut major part of it, yours will be longer.

You might also need to set sessionid cookie. This one is simple as you can use any value you like, assuming proper length (24) and alphabet (hex). Example below

sessionid=910fe127c0ca8ce7cd07d38d

If you set both of those values right, Steam might recognize it and present you logged-in session in the web browser. No guarantees though, as it has a lot of security mechanisms and it might also decide that you've done precisely what you did, stole those values from somewhere else (ASF), and it might invalidate them or refuse to use them because the origin (ASF, Steam client) does not match with yours (web browser). That'd require extra spoofing which is far beyond this already greatly out of the scope help.

Good luck :sgsmile:
Last edited by Archi; 20 Sep, 2024 @ 12:25am
Arno 20 Sep, 2024 @ 5:02pm 
Cool, thanks for the suggestion...I'll give it a shot. Fingers crossed!
< >
Showing 1-2 of 2 comments
Per page: 1530 50