3.48.2

The old way still seems to work, but this is what the official mobile app sends now

components/twofactor.js

@@ -20,10 +20,10 @@ SteamCommunity.prototype.enableTwoFactor = function(callback) {
 		// TODO: Send this as protobuf to more closely mimic official app behavior
 		form: {
 			steamid: this.steamID.getSteamID64(),
-			authenticator_time: Math.floor(Date.now() / 1000),
 			authenticator_type: ETwoFactorTokenType.ValveMobileApp,
 			device_identifier: SteamTotp.getDeviceID(this.steamID),
-			sms_phone_id: '1'
+			sms_phone_id: '1',
+			version: 2
 		},
 		json: true
 	}, (err, response, body) => {

components/webapi.js

@@ -1,49 +1,152 @@
-var SteamCommunity = require('../index.js');
+const SteamCommunity = require('../index.js');
 
 const Helpers = require('./helpers.js');
 
-SteamCommunity.prototype.getWebApiKey = function(domain, callback) {
+/**
-	var self = this;
+ * Retrieves your account's Steam Web API key, if you already have one. If you don't yet have one, this will fail.
+ * To create a Web API key, use `createWebApiKey()`.
+ *
+ * @param {null|function} unused - No longer used, kept for backward compatibility. You can omit this parameter and pass
+ *    your callback directly as the first parameter if you want.
+ * @param {function} callback
+ */
+SteamCommunity.prototype.getWebApiKey = function(unused, callback) {
+	if (typeof unused == 'function') {
+		callback = unused;
+	}
+
 	this.httpRequest({
-		"uri": "https://steamcommunity.com/dev/apikey?l=english",
+		uri: 'https://steamcommunity.com/dev/apikey?l=english',
-		"followRedirect": false
+		followRedirect: false
-	}, function(err, response, body) {
+	}, (err, response, body) => {
 		if (err) {
 			callback(err);
 			return;
 		}
 
-		if(body.match(/<h2>Access Denied<\/h2>/)) {
+		if (body.match(/You must have a validated email address to create a Steam Web API key./)) {
-			return callback(new Error("Access Denied"));
+			return callback(new Error('You must have a validated email address to create a Steam Web API key.'));
 		}
 
-		if(body.match(/You must have a validated email address to create a Steam Web API key./)) {
+		if (body.match(/Your account requires (<a [^>]+>)?Steam Guard Mobile Authenticator/)) {
-			return callback(new Error("You must have a validated email address to create a Steam Web API key."));
+			return callback(new Error('Steam Guard Mobile Authenticator required to create a Steam Web API key'));
 		}
 
-		var match = body.match(/<p>Key: ([0-9A-F]+)<\/p>/);
+		if (body.match(/<h2>Access Denied<\/h2>/)) {
-		if(match) {
+			return callback(new Error('Access Denied'));
+		}
+
+		let match = body.match(/<p>Key: ([0-9A-F]+)<\/p>/);
+		if (match) {
 			// We already have an API key registered
 			callback(null, match[1]);
 		} else {
-			// We need to register a new API key
+			callback(new Error('No API key created for this account'));
-			self.httpRequestPost('https://steamcommunity.com/dev/registerkey?l=english', {
+		}
-				"form": {
+	}, "steamcommunity");
-					"domain": domain,
+};
-					"agreeToTerms": "agreed",
+
-					"sessionid": self.getSessionID(),
+/**
-					"Submit": "Register"
+ * @typedef CreateApiKeyOptions
-				}
+ * @property {string} domain - The domain to associate with your API key
-			}, function(err, response, body) {
+ * @property {string} [requestID] - If finalizing an existing create request, include the request ID
-				if (err) {
+ * @property {string|Buffer} [identitySecret] - If you pass your identity_secret here, then steamcommunity will
-					callback(err);
+ *   internally handle accepting any confirmations.
+ */
+
+/**
+ * @typedef CreateApiKeyResponse
+ * @property {boolean} confirmationRequired
+ * @property {string} [apiKey] - If creating your API key succeeded, this is the new key
+ * @property {CreateApiKeyOptions} [finalizeOptions] - If confirmation is required to create a key, then accept the
+ *   confirmation, then call createWebApiKey again and pass this whole object for the `options` parameter.
+ */
+
+/**
+ * @callback createWebApiKeyCallback
+ * @param {Error|null} err
+ * @param {CreateApiKeyResponse} [result]
+ */
+
+/**
+ * Starts the process to create a Steam Web API key. When the callback is fired, you will need to approve a mobile
+ * confirmation in your app or using getConfirmations().
+ *
+ * @param {CreateApiKeyOptions} options
+ * @param {createWebApiKeyCallback} callback
+ */
+SteamCommunity.prototype.createWebApiKey = function(options, callback) {
+	if (!options.domain) {
+		callback(new Error('Passing a domain is required to register an API key'));
+		return;
+	}
+
+	this.httpRequestPost({
+		uri: 'https://steamcommunity.com/dev/requestkey',
+		form: {
+			domain: options.domain,
+			request_id: options.requestID || '0',
+			sessionid: this.getSessionID(),
+			agreeToTerms: 'true'
+		},
+		json: true
+	}, (err, res, body) => {
+		if (err) {
+			callback(err);
+			return;
+		}
+
+		// body.requires_confirmation is 1/0, but the Steam website doesn't check this value and instead only checks the
+		// value of `success`. So let's just do that.
+
+		// This is a mess. I'm glad we have promises and await now.
+
+		switch (body.success) {
+			case SteamCommunity.EResult.OK:
+				if (body.api_key) {
+					callback(null, {confirmationRequired: false, apiKey: body.api_key});
 					return;
 				}
 
-				self.getWebApiKey(domain, callback);
+				// It's not been observed that we get result OK without api_key included, but the Steam website doesn't
-			}, "steamcommunity");
+				// use this value so let's be safe just in case it disappears in the future.
+				this.getWebApiKey((err, key) => {
+					if (err) {
+						callback(err);
+						return;
+					}
+
+					callback(null, {confirmationRequired: false, apiKey: key});
+				});
+				return;
+
+			case SteamCommunity.EResult.Pending:
+				let finalizeOptions = {
+					domain: options.domain,
+					requestID: body.request_id || options.requestID
+				}
+
+				if (options.identitySecret) {
+					this.acceptConfirmationForObject(options.identitySecret, finalizeOptions.requestID, (err) => {
+						if (err) {
+							callback(err);
+						} else {
+							this.createWebApiKey(finalizeOptions, callback);
+						}
+					});
+					return;
+				}
+
+				callback(null, {
+					confirmationRequired: true,
+					finalizeOptions: finalizeOptions
+				});
+				return;
+
+			default:
+				callback(Helpers.eresultError(body.success));
 		}
-	}, "steamcommunity");
+	});
 };
 
 /**

examples/disable_twofactor.js

@@ -1,7 +1,7 @@
 // If you aren't running this script inside of the repository, replace the following line with:
 // const SteamCommunity = require('steamcommunity');
 const SteamCommunity = require('../index.js');
-const SteamSession = require('steam-session');
+const SteamTotp = require('steam-totp');
 const ReadLine = require('readline');
 
 let g_AbortPromptFunc = null;
@@ -13,69 +13,32 @@ async function main() {
 	let accountName = await promptAsync('Username: ');
 	let password = await promptAsync('Password (hidden): ', true);
 
-	// Create a LoginSession for us to use to attempt to log into steam
+	attemptLogin(accountName, password);
-	let session = new SteamSession.LoginSession(SteamSession.EAuthTokenPlatformType.MobileApp);
+}
 
-	// Go ahead and attach our event handlers before we do anything else.
+function attemptLogin(accountName, password, twoFactorCode) {
-	session.on('authenticated', async () => {
+	community.login({
-		abortPrompt();
+		accountName,
+		password,
+		twoFactorCode,
+		disableMobile: false
+	}, async (err) => {
+		if (err && err.message == 'SteamGuardMobile') {
+			let code = await promptAsync('Steam Guard App Code OR Shared Secret: ');
+			if (code.length > 5) {
+				// If we were provided a shared secret, turn it into a code.
+				code = SteamTotp.getAuthCode(code);
+			}
+			attemptLogin(accountName, password, code);
+			return;
+		}
 
-		let accessToken = session.accessToken;
+		if (err) {
-		let cookies = await session.getWebCookies();
+			throw err;
-
+		}
-		community.setCookies(cookies);
-		community.setMobileAppAccessToken(accessToken);
-
-		// Enabling or disabling 2FA is presently the only action in node-steamcommunity which requires an access token.
-		// In all other cases, using `community.setCookies(cookies)` is all you need to do in order to be logged in,
-		// although there's never any harm in setting a mobile app access token.
 
 		doRevoke();
 	});
-
-	session.on('timeout', () => {
-		abortPrompt();
-		console.log('This login attempt has timed out.');
-	});
-
-	session.on('error', (err) => {
-		abortPrompt();
-
-		// This should ordinarily not happen. This only happens in case there's some kind of unexpected error while
-		// polling, e.g. the network connection goes down or Steam chokes on something.
-
-		console.log(`ERROR: This login attempt has failed! ${err.message}`);
-	});
-
-	// Start our login attempt
-	let startResult = await session.startWithCredentials({accountName, password});
-	if (startResult.actionRequired) {
-		// Some Steam Guard action is required. We only care about email and device codes; in theory an
-		// EmailConfirmation and/or DeviceConfirmation action could be possible, but we're just going to ignore those.
-		// If the user does receive a confirmation and accepts it, LoginSession will detect and handle that automatically.
-		// The only consequence of ignoring it here is that we don't print a message to the user indicating that they
-		// could accept an email or device confirmation.
-
-		let codeActionTypes = [SteamSession.EAuthSessionGuardType.EmailCode, SteamSession.EAuthSessionGuardType.DeviceCode];
-		let codeAction = startResult.validActions.find(action => codeActionTypes.includes(action.type));
-		if (codeAction) {
-			if (codeAction.type == SteamSession.EAuthSessionGuardType.EmailCode) {
-				// We wouldn't expect this to happen since we're trying to disable 2FA, but just in case...
-				console.log(`A code has been sent to your email address at ${codeAction.detail}.`);
-			} else {
-				console.log('You need to provide a Steam Guard Mobile Authenticator code.');
-			}
-
-			let code = await promptAsync('Code: ');
-			if (code) {
-				await session.submitSteamGuardCode(code);
-			}
-
-			// If we fall through here without submitting a Steam Guard code, that means one of two things:
-			//   1. The user pressed enter without providing a code, in which case the script will simply exit
-			//   2. The user approved a device/email confirmation, in which case 'authenticated' was emitted and the prompt was canceled
-		}
-	}
 }
 
 async function doRevoke() {

examples/enable_twofactor.js

@@ -1,7 +1,6 @@
 // If you aren't running this script inside of the repository, replace the following line with:
 // const SteamCommunity = require('steamcommunity');
 const SteamCommunity = require('../index.js');
-const SteamSession = require('steam-session');
 const ReadLine = require('readline');
 const FS = require('fs');
 
@@ -16,69 +15,28 @@ async function main() {
 	let accountName = await promptAsync('Username: ');
 	let password = await promptAsync('Password (hidden): ', true);
 
-	// Create a LoginSession for us to use to attempt to log into steam
+	attemptLogin(accountName, password);
-	let session = new SteamSession.LoginSession(SteamSession.EAuthTokenPlatformType.MobileApp);
+}
 
-	// Go ahead and attach our event handlers before we do anything else.
+function attemptLogin(accountName, password, authCode) {
-	session.on('authenticated', async () => {
+	community.login({
-		abortPrompt();
+		accountName,
+		password,
+		authCode,
+		disableMobile: false
+	}, async (err) => {
+		if (err && err.message == 'SteamGuard') {
+			let code = await promptAsync('Steam Guard Email Code: ');
+			attemptLogin(accountName, password, code);
+			return;
+		}
 
-		let accessToken = session.accessToken;
+		if (err) {
-		let cookies = await session.getWebCookies();
+			throw err;
-
+		}
-		community.setCookies(cookies);
-		community.setMobileAppAccessToken(accessToken);
-
-		// Enabling or disabling 2FA is presently the only action in node-steamcommunity which requires an access token.
-		// In all other cases, using `community.setCookies(cookies)` is all you need to do in order to be logged in,
-		// although there's never any harm in setting a mobile app access token.
 
 		doSetup();
 	});
-
-	session.on('timeout', () => {
-		abortPrompt();
-		console.log('This login attempt has timed out.');
-	});
-
-	session.on('error', (err) => {
-		abortPrompt();
-
-		// This should ordinarily not happen. This only happens in case there's some kind of unexpected error while
-		// polling, e.g. the network connection goes down or Steam chokes on something.
-
-		console.log(`ERROR: This login attempt has failed! ${err.message}`);
-	});
-
-	// Start our login attempt
-	let startResult = await session.startWithCredentials({accountName, password});
-	if (startResult.actionRequired) {
-		// Some Steam Guard action is required. We only care about email and device codes; in theory an
-		// EmailConfirmation and/or DeviceConfirmation action could be possible, but we're just going to ignore those.
-		// If the user does receive a confirmation and accepts it, LoginSession will detect and handle that automatically.
-		// The only consequence of ignoring it here is that we don't print a message to the user indicating that they
-		// could accept an email or device confirmation.
-
-		let codeActionTypes = [SteamSession.EAuthSessionGuardType.EmailCode, SteamSession.EAuthSessionGuardType.DeviceCode];
-		let codeAction = startResult.validActions.find(action => codeActionTypes.includes(action.type));
-		if (codeAction) {
-			if (codeAction.type == SteamSession.EAuthSessionGuardType.EmailCode) {
-				console.log(`A code has been sent to your email address at ${codeAction.detail}.`);
-			} else {
-				// We wouldn't expect this to happen since we're trying to enable 2FA, but just in case...
-				console.log('You need to provide a Steam Guard Mobile Authenticator code.');
-			}
-
-			let code = await promptAsync('Code: ');
-			if (code) {
-				await session.submitSteamGuardCode(code);
-			}
-
-			// If we fall through here without submitting a Steam Guard code, that means one of two things:
-			//   1. The user pressed enter without providing a code, in which case the script will simply exit
-			//   2. The user approved a device/email confirmation, in which case 'authenticated' was emitted and the prompt was canceled
-		}
-	}
 }
 
 function doSetup() {
@@ -118,10 +76,13 @@ function doSetup() {
 
 async function promptActivationCode(response) {
 	if (response.phone_number_hint) {
-		console.log(`A code has been sent to your phone ending in ${response.phone_number_hint}.`);
+		console.log(`An activation code has been sent to your phone ending in ${response.phone_number_hint}.`);
+	} else if (response.confirm_type == 3) {
+		// Exact meaning of confirm_type is unknown, but 3 appears to be email code
+		console.log('An activation code has been sent to your email.');
 	}
 
-	let smsCode = await promptAsync('SMS Code: ');
+	let smsCode = await promptAsync('Activation Code: ');
 	community.finalizeTwoFactor(response.shared_secret, smsCode, (err) => {
 		if (err) {
 			if (err.message == 'Invalid activation code') {

index.js

@@ -154,16 +154,20 @@ SteamCommunity.prototype._setCookie = function(cookie, secure) {
 	var protocol = secure ? "https" : "http";
 	cookie.secure = !!secure;
 
-	this._jar.setCookie(cookie.clone(), protocol + "://steamcommunity.com");
+	if (cookie.domain) {
-	this._jar.setCookie(cookie.clone(), protocol + "://store.steampowered.com");
+		this._jar.setCookie(cookie.clone(), protocol + '://' + cookie.domain);
-	this._jar.setCookie(cookie.clone(), protocol + "://help.steampowered.com");
+	} else {
+		this._jar.setCookie(cookie.clone(), protocol + "://steamcommunity.com");
+		this._jar.setCookie(cookie.clone(), protocol + "://store.steampowered.com");
+		this._jar.setCookie(cookie.clone(), protocol + "://help.steampowered.com");
+	}
 };
 
 SteamCommunity.prototype.setCookies = function(cookies) {
 	cookies.forEach((cookie) => {
-		var cookieName = cookie.match(/(.+)=/)[1];
+		var cookieName = cookie.trim().split('=')[0];
 		if (cookieName == 'steamLogin' || cookieName == 'steamLoginSecure') {
-			this.steamID = new SteamID(cookie.match(/=(\d+)/)[1]);
+			this.steamID = new SteamID(cookie.match(/steamLogin(Secure)?=(\d+)/)[2]);
 		}
 
 		this._setCookie(Request.cookie(cookie), !!(cookieName.match(/^steamMachineAuth/) || cookieName.match(/Secure$/)));

package.json

@@ -1,6 +1,6 @@
 {
 	"name": "steamcommunity",
-	"version": "3.47.1",
+	"version": "3.48.2",
 	"description": "Provides an interface for logging into and interacting with the Steam Community website",
 	"files": [
 		"/classes",
@@ -33,7 +33,7 @@
 		"cheerio": "0.22.0",
 		"image-size": "^0.8.2",
 		"request": "^2.88.0",
-		"steam-session": "^1.6.0",
+		"steam-session": "^1.7.2",
 		"steam-totp": "^1.5.0",
 		"steamid": "^1.1.3",
 		"xml2js": "^0.6.2"