Architecture · ops.tradeit.gg

Authentication Flow

How users authenticate with tradeit.gg — Steam OpenID login, OAuth2, and session management.

Last updated: 2026-04-14

Authentication Flow

sequenceDiagram
    participant U as User Browser
    participant FE as new-tradeit
    participant LS as tradeit-login-server
    participant Steam as Steam OpenID
    participant Redis as Redis
    participant API as tradeit-backend
    participant DB as MySQL

    U->>FE: Click "Login with Steam"
    FE->>LS: Redirect to /auth/steam

    Note over LS,Steam: Steam OpenID Flow
        LS->>Steam: OpenID authentication request
        Steam->>U: Steam login page
        U->>Steam: Enter credentials
        Steam->>LS: OpenID callback with Steam ID

    Note over LS,Redis: Session Creation
        LS->>LS: Validate redirect URL against domain whitelist
        LS->>Redis: Create session (store Steam ID, profile)
        LS->>FE: Redirect with session cookie

    Note over FE,DB: Authenticated Requests
        FE->>API: API request with session cookie
        API->>Redis: Validate session
        API->>DB: Load user data (oauth2_users)
        API-->>FE: Authenticated response

Services

tradeit-login-server

• Role: Handles Steam OpenID authentication
• Stack: Express + Passport.js (forked passport-openid)
• Domain whitelist: Validates redirect URLs against allowed domains (prevents open redirect)
• Sessions: Stored in Redis with configurable TTL
• Single-file architecture: All logic in login.ts

tradeit-oauth2-server

• Role: OAuth2/OIDC provider for additional auth strategies
• Strategies: Steam, FACEIT, GitHub
• Stack: NestJS + TypeORM + Swagger
• Tokens: JWT-based authentication
• Used by: Third-party integrations, admin panel

Auth Strategies

Session Management

• Storage: Redis (ElastiCache)
• Format: Express session with Steam profile data
• Validation: Each API request checks session in Redis
• User table: oauth2_users in MySQL (schema: steamtrade)

Security Considerations

• Domain whitelist prevents open redirect attacks
• Forked passport library (compiled JS checked into repo for stability)
• No raw credentials stored — only Steam IDs and session tokens
• Redis session TTL for automatic expiration

Related Pages

• System Architecture — Where auth fits in the system
• Backend Services — Login and OAuth2 server details
• Trade Lifecycle — Auth is prerequisite for trading

ops.tradeit.gg — Internal Engineering Docs