All Steam websites (the store, community, the help site) use the same cookies to identify user sessions. There are four cookies which are required to identify a Steam session:
* = this cookie should only be sent over HTTPS
Despite its name, the
sessionid cookie is merely a CSRF token. Its value can be anything, as long as it matches the
sessionid POST parameter in your POST requests. Steam will randomly assign you one the first time you hit one of the websites without already having one, even if you aren't logged in. They are not tied to accounts or to sessions.
steamLoginSecure are the actual session cookies. Their format is: (your 64-bit SteamID + two pipe characters, percent encoded as %7C + a 40-character uppercase hexadecimal token). The hexadecimal token will differ between the two cookies, but the SteamID will be the same.
steamLoginSecure should be sent with all HTTPS requests, and only for HTTPS requests. These cookies are short-lived and once invalidated (the exact circumstances that cause them to be invalidated are unclear), you will be logged out.
steamMachineAuth<SteamID> is your Steam Guard identification cookie. You should replace
<SteamID> with your actual 64-bit SteamID, so for example the name of my cookie would be
steamMachineAuth76561198006409530. This cookie's value is simply a 40-character uppercase hexadecimal token. The cookie identifies a "machine" for Steam Guard, so that you don't have to provide an email code every time. This cookie is still present if you're using the mobile authenticator, even though you have to provide a code for every login. This cookie's issue date is also used as the "first sign in" date for purposes of determining trade restrictions. This cookie effectively lasts forever, so you should save it and reuse it between sessions. This cookie is required for trade offers to work.
Note: Since Steam switched to HTTPS-only,
steamLogin appears to no longer be necessary and is therefore no longer issued to web logins. It does seem to still be issued to Steam client-based logins.
How to Get Cookies
You can get Steam login cookies in one of three ways.
node-steamcommunitycan do this for you.
- You can use the undocumented IMobileAuthService/GetWGToken WebAPI method with an oAuth token.
node-steamcommunitycan do this for you.
- You can use the ISteamUserAuth/AuthenticateUser WebAPI method with a nonce (loginkey) received from the CM. Sessions negotiated this way will have no
steamMachineAuthcookie, and that cookie is unneeded for these sessions (trade offers will still work). Sessions negotiated this way will be invalidated as soon as the client session which received the CM nonce disconnects.
node-steam-usercan do this for you.
Once you have cookies, you can use them with any of a number of modules, e.g. node-steam-trade, node-steamcommunity, node-steamstore, etc.
Cookies expire and become invalid at seemingly-random times. There seems to be no real rhyme or reason as to when it happens, but it generally does happen whenever an account is logged in somewhere else, and on some unspecific time interval.
If you log in to Steam using node-steam-user, you will be issued cookies, but they are only linked to the CM session in that they will expire if the session disconnects. They also follow normal expiration rules, meaning that even if your Steam client session is still connected, your cookies might have expired and thus your web requests will indicate that you aren't logged in. If this happens, you'll need to use
webLogOn() to get new cookies.
- node-steamcommunity communicates with Steam over HTTP, which is stateless. Thus, cookies are required in order to authenticate your requests to your account. node-steamcommunity can either accept cookies using the
setCookiesmethod (which can accept cookies obtained by any means, including node-steam-user), or it can produce cookies using the
loginmethod. Either method will save the cookies internally in the SteamCommunity object and those cookies will be used to authenticate every HTTP request.
- node-steamstore is identical to node-steamcommunity, although it cannot create cookies (i.e. it can only accept them using
- node-steam-tradeoffer-manager is identical to node-steamstore, except it uses node-steamcommunity under the hood for its HTTP communication. Thus, if you instantiate TradeOfferManager and pass a
communityinstance to the constructor, calling
setCookieson the TradeOfferManager will also call
setCookieson the SteamCommunity, and therefore you need not call
setCookieson SteamCommunity (although it doesn't hurt anything, either).
- steam-user: producer
- steamcommunity: producer, consumer
- steamstore: consumer
- steam-tradeoffer-manager: consumer
- steam: producer
- steam-trade: consumer
Edited by Dr. McKay, 17 January 2019 - 06:58 PM.
Added info about Steam post-HTTPS-only, and cookie expiration