Call to Steam GetAuthTicketForWebApi isn't checking the returned handle for invalid

Development Programming & Scripting Multiplayer & Networking
, ,
1

The callback for the GetLinkedAccountAuthToken for Steam has a case where it won’t be called if it is for a WebAPI that triggers an error in Steam’s GetAuthTicketForWebApi.

We have changed the function locally to workaround this issue to be:

void FOnlineAuthSteam::GetAuthTicketForWebApi(const FString& RemoteServiceIdentity, FOnGetAuthTicketForWebApiCompleteDelegate CompletionDelegate)
{
	if (SteamUserPtr != NULL && SteamUserPtr->BLoggedOn())
	{
		const HAuthTicket TicketHandle = SteamUserPtr->GetAuthTicketForWebApi((const char*)StringCast<UTF8CHAR>(*RemoteServiceIdentity).Get());
		if (TicketHandle == k_HAuthTicketInvalid)
		{
			UE_LOG_ONLINE(Warning, TEXT("AUTH: Failed to get Steam auth ticket for web api, GetAuthTicketForWebApi failed"));
			CompletionDelegate.ExecuteIfBound(k_HAuthTicketInvalid, TEXT(""));
			return;
		}
		ActiveAuthTicketForWebApiRequests.Emplace(TicketHandle, CompletionDelegate);
	}
	else
	{
		UE_LOG_ONLINE(Warning, TEXT("AUTH: Failed to get Steam auth ticket for web api"));
		CompletionDelegate.ExecuteIfBound(k_HAuthTicketInvalid, TEXT(""));
	}
}
2

Steps to Reproduce
Calling FOnlineIdentitySteam::GetLinkedAccountAuthToken with a WebAPI:<invalid> routes to FOnlineAuthSteam::GetAuthTicketForWebApi:

void FOnlineAuthSteam::GetAuthTicketForWebApi(const FString& RemoteServiceIdentity, FOnGetAuthTicketForWebApiCompleteDelegate CompletionDelegate)
{
	if (SteamUserPtr != NULL && SteamUserPtr->BLoggedOn())
	{
		HAuthTicket TicketHandle = SteamUserPtr->GetAuthTicketForWebApi((const char*)StringCast<UTF8CHAR>(*RemoteServiceIdentity).Get());
		ActiveAuthTicketForWebApiRequests.Emplace(TicketHandle, CompletionDelegate);
	}
	else
	{
		UE_LOG_ONLINE(Warning, TEXT("AUTH: Failed to get Steam auth ticket for web api"));
		CompletionDelegate.ExecuteIfBound(k_HAuthTicketInvalid, TEXT(""));
	}
}

The TicketHandle isn’t checked against k_HAuthTicketInvalid so if SteamUserPtr->GetAuthTicketForWebApi fails, the callback is never called.

3

Hello Brent, thanks for your message.

I’ve reviewed & tested the code and it looks good, `OnlineAuthInterfaceSteam.cpp` stores the completion delegate in `ActiveAuthTicketForWebApiRequests` keyed by whatever handle `ISteamUser::GetAuthTicketForWebApi` returned, so when that call fails synchronously it returns `k_HAuthTicketInvalid` and *Steam* never fires `GetTicketForWebApiResponse_t`, so `OnGetTicketForWebResponse` never removes the entry and the `GetLinkedAccountAuthToken` lambda never runs -> the caller waits forever. Repeated failures also silently overwrote each other under key 0. Your proposed fix seems to be correct and mirrors the existing GetAuthTicket handling; We will consider doing a similar fix and adding a test-only constructor (WITH_DEV_AUTOMATION_TESTS guarded).

Thanks,

Juan