- Is sirwaddles/steamauth a Laravel package?
- No. Despite being listed as a Laravel/PHP package, sirwaddles/steamauth is a Symfony bundle (SteamAuthBundle). It has no Laravel ServiceProvider, facade, or auth driver, and its wiring assumes Symfony's DI container, security firewall, and HTTP kernel. Treat it as a reference implementation for the Steam OpenID handshake, not as a Laravel dependency.
- Can I install sirwaddles/steamauth in a Laravel app with Composer?
- You should not try to install it into a Laravel app's dependency graph. The bundle's Composer constraints likely pin Symfony components that conflict with what Illuminate already requires, and even a successful install would leave you with scaffolding your app cannot use. Extract or reference the OpenID logic instead of requiring the package.
- What Laravel versions does sirwaddles/steamauth support?
- None officially. The package targets Symfony, not Laravel, so there is no Laravel version support matrix. Its bundle-era conventions imply an older Symfony and PHP generation, and you should confirm the PHP floor against your runtime before any spike. For Laravel-native Steam login, use socialiteproviders/steam with laravel/socialite.
- What is the best alternative for Steam login in Laravel?
- The incumbent baseline for Laravel is socialiteproviders/steam on top of laravel/socialite. It is Laravel-native, maintained, and integrates with Socialite's existing authentication flow. Benchmark it before assuming a fork or an in-house build is necessary.
- How do I get a user's SteamID from Steam OpenID in Laravel?
- After a successful OpenID assertion, Steam returns a claimed_id URL whose final path segment is the 17-digit SteamID64. Validate that segment strictly with a 17-digit regex and verify the assertion signature and return_to/realm binding before trusting it. Then look up or create your user record and handle account-linking collisions explicitly.
- Does sirwaddles/steamauth provide Steam Web API data like owned games or player summaries?
- No. The package authenticates only; it does not touch the Steam Web API. It will not return owned games, inventory, player summaries, or ban data. Teams often conflate Steam sign-in with Steam Web API access and underestimate the downstream work.
- Is sirwaddles/steamauth safe for production authentication?
- Treat it as high risk for production auth. It has roughly 10 stars, zero dependents, a single maintainer, no visible release cadence, and no production validation in the wild. For authentication code, that provenance alone is close to disqualifying; use a maintained Laravel-native provider instead.
- Is sirwaddles/steamauth still maintained?
- There is no visible release cadence and the issue queue appears effectively frozen. The bundle targets an older Symfony generation, so expect stale PHP and Symfony pins. Check for any commit activity in the last 24 months and whether a security disclosure path exists before relying on it.
- How does Steam OpenID authentication work and what should I validate?
- Steam sign-in uses OpenID 2.0: you redirect the user to Steam, then receive an assertion back on your callback route. You must verify the signature, validate return_to and realm binding, and add replay protection before accepting the claimed_id. Note that OpenID 2.0 is a deprecated standard with no OAuth2 or OIDC equivalent from Valve, so any adoption inherits a sunset clock.
- Can I reuse the SteamAuthBundle OpenID logic in Laravel?
- Yes, as an extraction source under the MIT license. The durable value is the OpenID 2.0 handshake logic: redirect construction, assertion parsing, and signature and return_to validation, roughly 40 to 60 lines of real logic. Isolate it from Symfony's Request and Response types, wrap it in a Laravel service bound in a ServiceProvider, and vendor the extracted classes into app/ or a private package rather than installing the bundle.