Wanjohi 543fd3f361 fix(steam): link a Steam account only through Steam's own sign-in ...

POST /steam/link took a Steam id from the request body and linked it. A
Steam id is public, so anyone could claim any account, its library, and
the one free weekend that is keyed on it.

Linking is now POST /steam/link/start, which returns a Steam sign-in URL
tied to a one-time, ten-minute request, and GET /steam/link/callback,
where the browser comes back. The callback accepts the id only if Steam
confirms the assertion, the assertion was issued for exactly this
callback, and the id is read from Steam's claimed identity URL in the
one shape Steam issues it. The request is spent on use.

2026-10-07 10:52:19 +03:00

..

auth

style(auth): ring a refused or wrong answer red while it shakes

2026-10-02 06:10:05 +03:00

core

fix(steam): link a Steam account only through Steam's own sign-in

2026-10-07 10:52:19 +03:00