title: Suggestion in validating steam oauth and user registration steps in laravel
body: <p>I have a regular user registration in laravel but i extended it a bit to have an <code>confirmation</code> field as well. So i added <code>confirmed</code> field in database which can be true or false.</p>
  
  <p>And now i am trying to implement steam oauth to be able to login/register with steam too. And i used <code>invisnik/laravel-steam-auth</code>.</p>
  
  <p>Steam auth works fine but since steam doesn't supply email address upon authorization from steam, the user need to be redirected back to view which shows him email input form to confirm his email, if email is already in the database show email already taken message and suggest to login with email and link accounts. If email is not in the database register user and send him email confirmation link. And another step is if steam id is in database and email is in database and they match but user is not confirmed yet to send him message that he needs to confirm.</p>
  
  <p>There are few different approaches to this but i am concerned a bit with passing json data and security since i need to catch userid from steam and pass data into another view.</p>
  
  <p>So here is how basic controller looks from <code>laravel-steam-auth</code></p>
  
  <pre><code>use Invisnik\LaravelSteamAuth\SteamAuth;
  
  class SteamController extends Controller {
  
  /**
   * @var SteamAuth
   */
  private $steam;
  
  public function __construct(SteamAuth $steam)
  {
      $this-&gt;steam = $steam;
  }
  
  public function getLogin()
  {
      if($this-&gt;steam-&gt;validate()){
          $info = $this-&gt;steam-&gt;getUserInfo();
          if(!is_null($info)) {
          //For example
              User::create([
                  'username' =&gt; $info-&gt;getNick(),
                  'avatar' =&gt; $info-&gt;getProfilePictureFull(),
                  'steamid' =&gt; $info-&gt;getSteamID(),
                  //...
              ]);
          }
      }else{
          return  $this-&gt;steam-&gt;redirect(); //redirect to steam login page
      }
  }
  }
  </code></pre>
  
  <p>And this works fine the <code>$info</code> pass array of data from loged in user on steam.</p>
  
  <p>What i would need to implement a few different checks before i even register user and store any data in the database. This is example idea.</p>
  
  <p>First i created a route</p>
  
  <pre><code>Route::get('account/login/steam', ['as' =&gt; 'getSteamlogin', 'uses' =&gt; 'SteamController@getLogin']);
  </code></pre>
  
  <p>Next when i go to login page it redirects me to steam oauth system. When i login on steam it redirects me back to the same route.</p>
  
  <pre><code>class SteamController extends Controller {
  
  /**
   * @var SteamAuth
   */
  private $steam;
  
  public function __construct(SteamAuth $steam)
  {
      $this-&gt;steam = $steam;
  }
  
  public function getLogin()
  {
      if($this-&gt;steam-&gt;validate()){
          $info = $this-&gt;steam-&gt;getUserInfo();
          if(!is_null($info)) {
                //These are the steps that i need to perform the check
               //When user is loged in on steam, the $info returns data back such as userid, avatar, nickname, etc.
               // So i have to check if user exists already in database on my site
  
               $user = User::where('steamID', '=' , $info-&gt;getSteamID64())-&gt;first();
  
               //But if user doesn't exists it will return false of course so 
  
              if(!$user) {
  
               // I need to redirect the user to view with email input field and message that user is not registered
               // something like return view('register.steam')-&gt;with('message', 'This is your first time login with steam please insert your email');
               // the problem above is that view doesn't display message.
               }
  
               //And if user inserted message into register.steam view i need to post that and validate if email doesn't exists in database already.
               // If email exists display message that email is already taken and that he can use different email or login with existing email and link his account.
  
               //Next check should be 
               // If user insert correct email that doesn't exist in database register user using id from steam, nickname, avatar, and email he inserted
               // The steamid, nickname, avatar are returned from oauth system and it can be retrieved like this
               // $info-&gt;getSteamID64();
               // $this-&gt;getNick();
               // $this-&gt;getProfilePictureFull();
               // And email is from input email field from the form i mentioned above.
  
               //And last if everything is ok and user is already registered and confirmed log him in
  
               Auth::login($user);
  
          }
      }else{
          return  $this-&gt;steam-&gt;redirect(); //redirect to steam login page
      }
  }
  }
  </code></pre>
  
  <p>The biggest problem i have is to understand yet how to pass array of data from view to view in secure way without user abbility to edit or change data, the ways i tried i either get <code>$info-&gt;getSteamID64();</code> is empty or  csrf protection that token missmatch.</p>
  
  <p>Any suggestions and help would be very much appreciated. </p>