A PSA on Steam identifier support

Using the fivem Account isnt possible?
Each player have to create a fivem account and login with this. Then give him a unique id and use this a identifier?!

What are the requirements to get an AppID? Apparently JC:MP (click) has a valid AppID, so it seems to be somehow possible for mods to get one.

Greetings!

If the game developers arenā€™t against such mod, sure.
I doubt Rockstar Games would just let it slide. Valve would probably get a complaint in .5 seconds.

In the first way yes, but the ā€œBanā€ system would need to run on another ā€œsystemā€ because of that you can make new accounts anyday.

Yeah but Iā€™m still lost how you would authenticate at the point of connection to the server, if you donā€™t use an identifier available in the identifiers array. The player registers and gets a unique identifier - thatā€™s fine, you can create whatever you want in a database - but how does the FiveM client check against that?

Whatever custom identifier you make, I cannot see how the client would have this available to pass to the server and then be allowed onto the server or rejected depending if itā€™s whitelisted or found in the database etc.

The way I see it is you have to use an identifier in the identifier array (with license being the only one guaranteed to be there it seems).

Technically FiveM or atleast FiveReborn used Rockstarā€™s code so if they did get an AppID, chances are they would get removed.

Out of curiosity, isnā€™t there a way to get a playerā€™s steamid via a function outside of the native method? Couldnā€™t we just use an alternative method to get that id?

I think the problem is getting it in a reliable way, so you canā€™t influene it.

1 Like

Seriously the problem isnā€™t that big as it looks like ā€¦

There are tons of ways how to work with a database without steam identifiersā€¦
Like a login panel or the GetPlayerName native, which would call the Name of the PC connecting. (Or Steam as long Steam is available)
The only Problem is, that noone tryā€™s it and If someone tried he didnā€™t released it to anyone.

Let me just throw this in, please donā€™t use GetPlayerName as an identifier for accountsā€¦

2 Likes

Nah mate thatā€™s fine. Just like allowing cracked minecraft accounts to join your server where servers still use names as unique identifiers.

If someone someday gets a solution please consider to share with the community :slight_smile:

I mean, the solution is using licenses as an identifier

2 Likes

More detailed about to do this? Here are people that is not programmer masters.

Iterate over all available identifiers by using GetPlayerIdentifiers(). Then decide which is license from each identifier.

For exampleā€¦

for k, v in ipairs(GetPlayerIdentifiers(player)) do
    if string.match(v, "license:") then
        license = v
        break
    end
end
2 Likes

Seriously the problem isnā€™t that big as it looks like ā€¦

No offence, but if youā€™re suggesting as a solution to use the players name as a way to uniquely verify a player to an account/save data then Iā€™m worried you donā€™t really grasp the importance of a good identifier system.

If the person connecting can change freely the unique reference to that users account then it wonā€™t work. What youā€™re suggesting is I could connect, find out another players username, change mine to it and connect to the server laterā€¦ and any save data Iā€™ve just effectively hijacked off that other player.

And you canā€™t get a login panel to appear at the point of connection (where most whitelisting is done) as you would have had to have connected and downloaded resources by that point - for most way too late.

And Steam, well this post here is telling you to prepare to lose this identifier in the immediate future so you shouldnā€™t be using it to support or backup a non-secure identifier.

The issue isnā€™t just having a way to link a player to an account, but actually having it so this link is unique and not possible to change/influence by the user.
I can find out your game licence and steamid etc easy enough, but can I change mine so itā€™s someone elses steamid/licence when I connect? I donā€™t think so - and thatā€™s the key part here.

Can you spoof someones gta licence? Unlikely.
Could you have spoofed someones steam licence? I doubt it.
Can you spoof someones username? Absolutely.

If the Steam application is changing so FiveM canā€™t find out the info it needs from the Steam Client (I suspect how it has done so far) then there is likely no other easy way to access that information. Any web API function would be too easy to spoof the return data.

As seen before, the gta licence is the only identifier you can reliabily use going forward. Itā€™s presented on 100% of connections to your server and is unique to their install of the game. They might be able to change it, but only by a new game and not by changing the value themselves I suspect.

Yeah, suggestion, it was a example on what I mean, I wouldnā€™t use the players Name as a identifier.

Well I guess you donā€™t understand me here, If playersname If someone would use it, should never be the only identifier, that means that there is still a gta licenense and a login panel, what getā€™s checked too.

Seriously, I know that :joy:
You can still make a control panel ingame, like how for example ESXKashacters works, just with a control panel, Itā€™s nƶ problem to spawn the player firtly as a noob and then If he logged in, to give him access to his char, inventory etc.

Well I am very sorry, but thatā€™s not trueā€¦
If I would buy a modded account Iā€™ll probably get the same lisence as the other ones that buy it there. (As you can follow in the replies)

Aand on top of that I am pretty sure that the license would change if you reinstall gtaā€¦

Have a nice day!

whats a password lul

where i can read information another information about this?

there steam publish news about identifiers/steam ids?

1 Like

Do you even need to get Greenlit for using your own App ID? As far as I know you just have to get your App release stage over the ā€œUnavailableā€ part then your App ID can be used. Worst case you just use the Source SDK one.

Would you be breaking any ToS by using Source SDKā€™s App ID? I know you guys have a reverse engineered steam api right now that lets you set the name of your app and such but I would much rather keep using Steam and have it tell people Iā€™m playing Source SDK rather than give it up completely.