title: OpenID authentication through Steam
body: <p>I've spent the better part of the day trying to figure out how OpenID works. My goal is to set up a simple site where, upon clicking a login button, users are taken to a Steam login-page, where they are prompted for username and password. After successfully logging in, the user is redirected to a page on my domain, where I collect the query string parameters. They look like this:</p>
  
  <pre><code>{  
      "openid.ns": "http://specs.openid.net/auth/2.0",
      "openid.mode": "id_res",
      "openid.op_endpoint": "https://steamcommunity.com/openid/login",
      "openid.claimed_id": "https://steamcommunity.com/openid/id/7656119[0000000000]",
      "openid.identity": "https://steamcommunity.com/openid/id/7656119[0000000000]",
      "openid.return_to": "http://127.0.0.1:8000/resolve",
      "openid.response_nonce": "2018-12-01T14:49:46Z30hhn2/[someTEXTendingIN=]",
      "openid.assoc_handle": "1234567890",
      "openid.signed": "signed,op_endpoint,claimed_id,identity,return_to,response_nonce,assoc_handle",
      "openid.sig": "[someTEXTandNUMBERSendingIN=]"
  }
  </code></pre>
  
  <p>What I am unable to solve though, is the actual authentication issue. I'm not sure what to do with this data. I want to have my own database where I store more information about the user, such as friends, messages, currency etc. For this, it is very important that I can verify that someone didn't just take this request body, change their ID for another and in that way access their account.</p>
  
  <p>I'm pretty sure <a href="https://openid.net/specs/openid-authentication-1_1.html" rel="nofollow noreferrer">these</a> are the relevant pieces of documentation, but it still isn't clear to me. How am I supposed to authenticate the user with this data?</p>
  
  <p>I've omitted some values in this post that I fear could be bad to share. These placeholders have been outlined with brackets <code>[]</code>. Also, that <code>assoc_handle</code> is really <code>1234567890</code>, which kind of puts me off, since according to the OpenID documentation, it is used for determining the signature.</p>
  
  <p>To be clear: this page where credentials are collected is not run by me, but is the official OpenID sign-in page for Steam. Steam is a gaming platform. <a href="https://steamcommunity.com/dev/" rel="nofollow noreferrer">https://steamcommunity.com/dev/</a> for reference.</p>