Unable to sign in when starting with npm run start, but it works with npm run dev.

[Hibari233]

When deploying the latest code from the repository, an issue arises where using "npm run start" prevents login, while "npm run dev" works. After checking the browser cookies, it was found that the web application started with "npm run start" does not set any cookies upon login. The behavior observed is that after logging in, the application redirects back to the homepage and remains in a logged-out state. Please assist me. Thank you!

[ianlucas]

When you say "npm run start" you mean you deployed your code to prod, and it's not logging in, right? If so, please check the public."Rules" table, specifically steamApiKey and steamCallbackUrl rules. Environment variables for Steam authentication are not used after the rules are populated.

[Hibari233]

Yes, I have checked the steamApiKey and steamCallbackUrl in the database, and their configurations are correct. I am considering whether the issue might be related to using a proxy, as my deployment environment is in China and needs to bypass the Great Firewall (GFW). I am currently testing on a server outside of China.

[ianlucas]

Yeah, it could be related, but it does sucks that Inventory Simulator currently doesn't print any kind of error message. Sometime tomorrow (11:58 PM here), I'll try to update the Steam authentication library to print some error messages whenever it faces an issue to help further debug your issue. I'll move this into an issue.

[Hibari233]

OK! Thank you!

[ianlucas]

Okay, try the latest commit and let me know if you have a meaningful error message for the authentication.

[Hibari233]

Still unable to log in, and it doesn’t seem to show any meaningful information.
The terminal shows like this.

GET / 200 - - 1231.056 ms

GET /localizations/english.819a3ae.js 200 - - 33.936 ms

GET /sign-in?_data=routes%2Fsign-in._index 204 - - 884.572 ms

GET /sign-in/steam/callback?openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0&openid.mode=id_res&openid.op_endpoint=https%3A%2F%2Fsteamcommunity.com%2Fopenid%2Flogin&openid.claimed_id=https%3A%2F%2Fsteamcommunity.com%2Fopenid%2Fid%2F76561198973801026&openid.identity=https%3A%2F%2Fsteamcommunity.com%2Fopenid%2Fid%2F76561198973801026&openid.return_to=http%3A%2F%2Fs.qvq.pet%3A3000%2Fsign-in%2Fsteam%2Fcallback&openid.response_nonce=2024-08-24T01%3A39%3A47Zw4gwjzd2D25VueAlyT4tdUiplgs%3D&openid.assoc_handle=1234567890&openid.signed=signed%2Cop_endpoint%2Cclaimed_id%2Cidentity%2Creturn_to%2Cresponse_nonce%2Cassoc_handle&openid.sig=y7%2FwMYuSyNuvB9%2Ffto8IO12GYj4%3D 302 - - 1493.413 ms

GET /api/action/preferences 302 - - 1.985 ms

GET / 200 - - 26.698 ms

[Hibari233]

I also tested non-proxy server yesterday, and it seems the issue isn’t related to the proxy.

[ianlucas]

Yeah, that's weird. Since it redirected to /api/action/preferences it means the authentication was successful... I can only think of two things:

1. Check SESSION_SECRET has a value in .env. If it has, see if GET /sign-in/steam/callback request is setting the cookie header correctly.
2. Test in another browser just to make sure it's not the culprit.

[Hibari233]

It looks like I’ve found the cause of the issue. While checking the callback request, I noticed a warning: This attempt to set a cookie via a Set-Cookie was blocked because it had the ‘Secure’ attribute. It seems the problem is related to HTTPS. The reason the login works in the development environment is that the secure attribute wasn’t set there. I’ll add HTTPS and try again.

[ianlucas]

Development works because "localhost" is considered secure by the browser, any other domain needs SSL to work. Glad you found the issue, thanks for letting me know.