Safety, and having a free to play demo version with a different steamapp ID without access to playfab.

Question

question

Ruben Pascual Blanco asked Feb 14, '23

Safety, and having a free to play demo version with a different steamapp ID without access to playfab.

The idea is that users who pay the game have access to playfab via Steam login allowing them access to official matchmaking and progression, while users who just get the free demo play in a sort of "offline mode" only connected to steam itself so they don't cause any cost to use when it comes to API calls, servers and such. But I have some questions:

-Does steam login actually require full legitimate ownership of the game in your account? Or just knowing the steam id of the game? I am asking just in case crackers can fake a steam login with the full game ID instead of the demo ID and cause playfab costs trough calling API or even maliciously spamming them. Can the Steam ticket string be faked?

-Is there any login method that can require ownership of certain DLC? In this case we could, instead of the demo router, go trough the DLC route for the full version and integrate everything in the same App.

-And at last: How could we go about handing a dedicated server to players that they can set up and make compatible with playfab (client API)? I read that servers use some sort of Anonymous steam login so there is no actual check for ownership going on, right? So in this case, if we enable playfab for dedicated servers we could again encounter hackers who did not buy the game causing costs in API calls.

Thanks!

apis Account Management

10 |1200

Attachments: Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

Answer 1 · 2023-02-15T03:17:24Z

Gosen Gao answered Feb 15, '23

Does steam login actually require full legitimate ownership of the game in your account? Or just knowing the steam id of the game? I am asking just in case crackers can fake a steam login with the full game ID instead of the demo ID and cause playfab costs trough calling API or even maliciously spamming them. Can the Steam ticket string be faked?

Authentication - Login With Steam - REST API (PlayFab Client) | Microsoft Learn requires the SteamTicket, any Steam users can get it and use it to login. PlayFab only communicates with Steam to see if the ticket is valid.

Is there any login method that can require ownership of certain DLC? In this case we could, instead of the demo router, go trough the DLC route for the full version and integrate everything in the same App.

No, LoginWithSteam only requires a valid SteamTicket, PlayFab won’t check the ownership.

And at last: How could we go about handing a dedicated server to players that they can set up and make compatible with playfab (client API)? I read that servers use some sort of Anonymous steam login so there is no actual check for ownership going on, right? So in this case, if we enable playfab for dedicated servers we could again encounter hackers who did not buy the game causing costs in API calls.

Servers - PlayFab | Microsoft Learn is a session-based service, players can join a server through Matchmaking service or using API Multiplayer Server - Request Multiplayer Server - REST API (PlayFab Multiplayer) | Microsoft Learn to request a server directly. If you let paying users and free-to-play users use the same client version, then all issues above can happen. I would recommend that just provide the free-to-play users a client that doesn’t include any PlayFab service as you want ‘a free to play demo version without access to playfab’.

2

10 |1200

Attachments: Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

Ruben Pascual Blanco commented · Feb 15, 2023 at 08:06 PM

Thanks for the answers! Our doubts is if said valid SteamTicket requires owning the game from steam itself or Steam itself can be "deceived" by hackers. I mean if Steam itself checks for this before generating a valid session ticket. Also does Playfab check said ticket agaisnt Steam? meaning Steam itself has to validate it again, or could a hacker generate a "fake valid" steam ticket?.

Thanks!

0 ·

Gosen Gao Ruben Pascual Blanco commented · Feb 16, 2023 at 06:02 AM

You can refer to this, when getting the session ticket, there is no parameters for checking ownership. And we are using Steam service to check the ticket, so the Steam will validate it again.

0 ·

question