GRUPO DE STEAM
Archi's SC Farm Archi-ASF
GRUPO DE STEAM
Archi's SC Farm Archi-ASF
66,440
JUGANDO
427,725
ONLINE
Fundado
29 de octubre de 2015
Idioma
Inglés
Arno 19 SEP 2024 a las 21:37
Unable to log in via Web but ASF still authenticated
So, this is kind of out of left field and (as far as I can tell) not a problem with ASF, but I'm wondering if there's something I can do to troubleshoot.

I've got four accounts (my main and three low-traffic alts) with ASF active on all of them. Recently (about three days ago) I'm not able to log in (on the Steam Web site) to two of the alts; I'm getting a username/password error. I know I'm not typoing them because they're coming from a password manager. Not panicking yet, but I'm starting to get a teensy bit worried that they may have been compromised.

Anyway, the reason I'm posting here is I'm wondering if there's anything I can leverage in ASF, which is still logged in to all four accounts at the moment, to see if anything's wrong. Does ASF have any kind of functionality to, say, retrieve my account's recent login IP list?

I'm hesitant to try by exiting ASF and starting it back up, 'cause then if it doesn't work I'm worse off than I am now; at least as things are I've still got a valid, authenticated session with those two users that I can potentially do stuff with.
Publicado originalmente por Archi:
In Bot.db file ASF saves crucial login properties, in particular BackingAccessToken. If you're not using ASF encryption (default PasswordFormat value in bot's config) then those properties are available to you in plaintext format. You can simply let ASF running and get its value from the DB file. Keep in mind access token is short-lived (IIRC around 24h) so you might need to wait for ASF to fetch new token for you and use that one when the old one is revoked.

When you extract the value, use https://jwt.io/ for verification that you extracted the correct thing. There should be no decoding errors or anything, you should get token properties on the right, nothing of interest for you but we use it as additional validation.

Once you confirm you got the right token, you can manually use it in steamLoginSecure value in the cookies. The value should be <yourSteamId64>||<BackingAccessToken>. The || should be encoded (%7C) in the value. Here is example for my account:

steamLoginSecure=76561198006963719%7C%7CeyAidHl(...)YjuOAw - My token starts with "eyA" and ends with "OAw". Of course I cut major part of it, yours will be longer.

You might also need to set sessionid cookie. This one is simple as you can use any value you like, assuming proper length (24) and alphabet (hex). Example below

sessionid=910fe127c0ca8ce7cd07d38d

If you set both of those values right, Steam might recognize it and present you logged-in session in the web browser. No guarantees though, as it has a lot of security mechanisms and it might also decide that you've done precisely what you did, stole those values from somewhere else (ASF), and it might invalidate them or refuse to use them because the origin (ASF, Steam client) does not match with yours (web browser). That'd require extra spoofing which is far beyond this already greatly out of the scope help.

Good luck :sgsmile:
< >
Mostrando 1-2 de 2 comentarios
Un moderador de este foro ha indicado que este mensaje responde al tema original.
Archi 20 SEP 2024 a las 0:24 
In Bot.db file ASF saves crucial login properties, in particular BackingAccessToken. If you're not using ASF encryption (default PasswordFormat value in bot's config) then those properties are available to you in plaintext format. You can simply let ASF running and get its value from the DB file. Keep in mind access token is short-lived (IIRC around 24h) so you might need to wait for ASF to fetch new token for you and use that one when the old one is revoked.

When you extract the value, use https://jwt.io/ for verification that you extracted the correct thing. There should be no decoding errors or anything, you should get token properties on the right, nothing of interest for you but we use it as additional validation.

Once you confirm you got the right token, you can manually use it in steamLoginSecure value in the cookies. The value should be <yourSteamId64>||<BackingAccessToken>. The || should be encoded (%7C) in the value. Here is example for my account:

steamLoginSecure=76561198006963719%7C%7CeyAidHl(...)YjuOAw - My token starts with "eyA" and ends with "OAw". Of course I cut major part of it, yours will be longer.

You might also need to set sessionid cookie. This one is simple as you can use any value you like, assuming proper length (24) and alphabet (hex). Example below

sessionid=910fe127c0ca8ce7cd07d38d

If you set both of those values right, Steam might recognize it and present you logged-in session in the web browser. No guarantees though, as it has a lot of security mechanisms and it might also decide that you've done precisely what you did, stole those values from somewhere else (ASF), and it might invalidate them or refuse to use them because the origin (ASF, Steam client) does not match with yours (web browser). That'd require extra spoofing which is far beyond this already greatly out of the scope help.

Good luck :sgsmile:
Última edición por Archi; 20 SEP 2024 a las 0:25
Arno 20 SEP 2024 a las 17:02 
Cool, thanks for the suggestion...I'll give it a shot. Fingers crossed!
< >
Mostrando 1-2 de 2 comentarios
Por página: 1530 50