Weave Code
Steam Socialite Laravel Package
truckersmp/steam-socialite
A Laravel Socialite provider for Steam authentication. Let users sign in with Steam and retrieve their Steam profile data using a familiar Socialite driver, making it easy to add Steam login to Laravel apps and community platforms.
Laravel Socialite provider for Steam OpenID.
Frequently asked questions about Steam Socialite
- How do I install and configure Steam login in Laravel using this Socialite provider?
- Install it with composer require truckersmp/steam-socialite; Laravel package auto-discovery registers the service provider, and you add a steam entry to config/services.php with your Steam credentials. Then add two routes, one calling Socialite::driver('steam')->redirect() and one calling ->user() on the callback, and persist the returned Steam ID against your local user record. No migrations, queues or storage tables are added by the package itself, so all persistence decisions stay in your application code.
- Which Laravel versions does truckersmp/steam-socialite support?
- The package targets Laravel 9, 10 and 11 with laravel/socialite already installed, and follows standard Socialite driver conventions. Because it plugs into the existing Socialite manager, it can run side by side with Google, Discord or GitHub providers in the same application. Check the composer.json constraints before upgrading your Laravel major version, since a single-maintainer package may lag new framework releases.
- Why did Steam login stop working behind my load balancer or CDN after upgrading to 1.10.0?
- Version 1.10.0 binds the OpenID callback to the exact redirect URL the user came from, so a mismatched scheme or host is rejected. Behind a TLS-terminating proxy, CDN or ingress, Laravel sees the internal http URL unless TrustProxies is configured for the real header chain. This is the most common cause of a post-upgrade auth outage, and the failure is a hard 100% login failure rather than silent degradation. Fix the trusted proxy configuration rather than loosening the check.
- What is GHSA-cfcr-wjg4-3vx9 and how urgent is the upgrade?
- It is a security advisory describing Steam OpenID assertions issued for another site being accepted by the provider, which lets an attacker sign in as an arbitrary user. On any deployment handling real accounts that is a full account-takeover primitive, so it should be treated as a security incident rather than a routine dependency bump. Version 1.10.0 fixes it and also adds strict OpenID endpoint and Steam ID format verification. Upgrade deliberately, verify the rollout, and audit whether any past login anomalies could have exploited it.
- Do I need to call stateless() for API, mobile or SPA Steam authentication?
- Yes. The driver keeps CSRF state in the session, so the redirect and callback routes must run inside the web middleware group with sessions started. If you are authenticating from an API route, a mobile handoff or an SPA calling a token endpoint, you must explicitly call stateless() on both the redirect and the callback. Missing it on either end causes authentication to fail, so keep the two sides consistent.
- How do I test Steam authentication in my Laravel test suite?
- Do not stub a fake OpenID endpoint or hand-build Steam IDs, because 1.10.0 verifies the canonical OpenID endpoint and enforces strict 64-bit Steam ID formatting, so those harnesses will break. Instead mock or bind a fake Socialite driver so your controller and account-linking logic are tested without touching the network. Also review any tests that previously passed only because the endpoint check was lenient, since they may have been masking the vulnerability.
- Is this package safe for production apps handling payments or personal data?
- It is a niche, single-maintainer community package from TruckersMP with a small user base, which means low bus factor. For gaming communities and similar products it is a reasonable fit, but for payments or PII it deserves a conscious sign-off and a plan for what happens if maintenance stalls. Ensure you have a backup sign-in method, durable storage of the Steam ID to local user mapping, and a process for receiving Socialite and Laravel security advisories.
- Will composer update automatically pull the breaking 1.10.0 changes?
- Yes, if you use a caret constraint such as ^1.9 the next composer update will adopt 1.10.0 without a deliberate upgrade step. The release contains semantically breaking behaviour changes, including callback URL binding, session state enforcement and strict verification, but it ships as a minor version. Pin an exact version in production, read the changelog before updating, and roll out behind a staging environment where a login outage is detectable.
- What Steam profile data can I get, and how should I store the Steam ID?
- Calling ->user() returns a Socialite user object populated from the Steam Web API, including the 64-bit Steam ID plus profile fields such as persona name and avatar. Store the Steam ID as a string column, not an integer, and index it so you can look up accounts during login and support linking an existing local account. Persisting the link durably also lets you survive a temporary Steam login outage without losing user associations.
- What are the alternatives to this package for Steam authentication in Laravel?
- The other common route is the community socialiteproviders/steam package, which also wraps Steam OpenID as a Socialite driver, and some teams implement the OpenID flow directly for full control. Compare them on maintenance activity, Laravel version support, and whether they enforce endpoint and Steam ID validation, since that is exactly where this advisory lived. If you switch, replicate the callback URL and session-state requirements so behaviour stays consistent across providers.
Weaver
How can I help you explore Laravel packages today?