How to ensure a malicious community server cannot impersonate a user?

Question

I am using a server model similar to Steam or Minecraft:

• There are community servers run by players and a hub authentication server that I control.

• The client player logs into the game and receives a session token.

• When the player wants to connect to a server, they request from the authentication server to exchange their session token for a server session token.

• They then pass that server session token to the server which then checks with the authentication server if the token is valid, and if it is, the community server lets the client in.

My issue is, this gives the UGC server a lot of power. I know that if the UGC server is fully moddable, you can't stop a lot of stuff, but the main issue is that if a malicious admin intercepts this server session token packet from the client, the admin can use this to connect to an entirely new server pretending to be the client.

I need a solution to fix this and make a model similar to Steam or Minecraft's models. thank you.

Answer 1

Instead of jury-rigging your own solution, you should look at existing open-source solutions to this very problem. Like OpenID, for example.

OpenID works basically like this:

1. The client connects to the server, telling it its username.
2. The server connects the authentication provider, asking it to verify a login attempt for a specific username. This login attempt also gets an unique login id, which it tells both the client and the authentication provider.
3. The client connects to the authentication provider and tells it "I would like to perform the authentication for [login id]. Here are my credentials".
4. The authentication provider confirms that the credentials check out, and when that's the case responds to the server that the login with this id was successful.
5. The server lets the client into the game.

(Needless to say that all of this should happen through encrypted channels.)

Impersonation is impossible in this case because the login process requires direct communication between server and authentication provider. And because each login attempt gets an own unique ID, there is no opportunity for replay attacks.

If you would like to use this process, then please remember: DO NOT INVENT YOUR OWN CRYPTO! Anyone can come up with a security scheme they can't crack themselves. If possible, rely on a tried and tested open-source implementation.