From 1252f7bd35d6d2a837b9b423808fbe0442054344 Mon Sep 17 00:00:00 2001 From: gamer147 Date: Mon, 1 Jun 2026 01:12:21 -0400 Subject: [PATCH] fix(battle-node): read WS credentials from headers; skip Steam auth on WS upgrades MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two issues caught in the real-client smoke: 1) BestHTTP's SocketOptions.AdditionalQueryParams puts BattleId and viewerId on HTTP request HEADERS for WebSocket-only transport (NOT on the URL query string as the in-battle/transport.md spec says). Real clients therefore send them as headers; our handler was reading from query and rejecting every connect with "Unknown battle/viewer pair: /". Fix: header-first, query- fallback (so the integration test still works against TestServer). 2) The Steam auth handler was running on every WS upgrade and throwing NotSupportedException on Request.Body.Seek (Kestrel's HttpRequestStream doesn't support Seek, and a WS upgrade is GET with Content-Length: 0 anyway). It flooded logs and added no value — the battle node has its own per-connection credentials. Skip auth when IsWebSocketRequest is true. Spec correction for in-battle/transport.md to follow. Co-Authored-By: Claude Opus 4.7 --- .../Hosting/BattleNodeWebSocketHandler.cs | 18 +++++++++++++++--- .../SteamSessionAuthenticationHandler.cs | 9 +++++++++ 2 files changed, 24 insertions(+), 3 deletions(-) diff --git a/SVSim.BattleNode/Hosting/BattleNodeWebSocketHandler.cs b/SVSim.BattleNode/Hosting/BattleNodeWebSocketHandler.cs index dfd1230..1a2d27a 100644 --- a/SVSim.BattleNode/Hosting/BattleNodeWebSocketHandler.cs +++ b/SVSim.BattleNode/Hosting/BattleNodeWebSocketHandler.cs @@ -27,10 +27,15 @@ public sealed class BattleNodeWebSocketHandler return; } - var battleId = ctx.Request.Query["BattleId"].ToString(); - var encryptedViewerId = ctx.Request.Query["viewerId"].ToString(); + // BestHTTP's SocketOptions.AdditionalQueryParams puts these on HTTP request HEADERS + // for the WebSocket-only transport (not on the URL query string). Real clients + // therefore send BattleId/viewerId as headers; the integration test sends them as + // query params for convenience. Check headers first, fall back to query. + var battleId = ReadCredential(ctx, "BattleId"); + var encryptedViewerId = ReadCredential(ctx, "viewerId"); if (string.IsNullOrEmpty(battleId) || string.IsNullOrEmpty(encryptedViewerId)) { + _log.LogWarning("WS upgrade missing BattleId or viewerId (header or query)."); ctx.Response.StatusCode = StatusCodes.Status400BadRequest; return; } @@ -43,7 +48,7 @@ public sealed class BattleNodeWebSocketHandler } catch (Exception ex) { - _log.LogWarning(ex, "viewerId query param failed to decrypt"); + _log.LogWarning(ex, "viewerId failed to decrypt (encryptedLen={Len})", encryptedViewerId.Length); ctx.Response.StatusCode = StatusCodes.Status400BadRequest; return; } @@ -61,4 +66,11 @@ public sealed class BattleNodeWebSocketHandler var session = new BattleSession(ws, battleId, viewerId, _loggerFactory.CreateLogger()); await session.RunAsync(ctx.RequestAborted); } + + private static string ReadCredential(HttpContext ctx, string name) + { + var header = ctx.Request.Headers[name].ToString(); + if (!string.IsNullOrEmpty(header)) return header; + return ctx.Request.Query[name].ToString(); + } } diff --git a/SVSim.EmulatedEntrypoint/Security/SteamSessionAuthentication/SteamSessionAuthenticationHandler.cs b/SVSim.EmulatedEntrypoint/Security/SteamSessionAuthentication/SteamSessionAuthenticationHandler.cs index ccab962..485bf25 100644 --- a/SVSim.EmulatedEntrypoint/Security/SteamSessionAuthentication/SteamSessionAuthenticationHandler.cs +++ b/SVSim.EmulatedEntrypoint/Security/SteamSessionAuthentication/SteamSessionAuthenticationHandler.cs @@ -35,6 +35,15 @@ public class SteamSessionAuthenticationHandler : AuthenticationHandler HandleAuthenticateAsync() { string path = Request.Path; + // WebSocket upgrades carry no body — Request.Body.Seek throws NotSupportedException + // on Kestrel's HttpRequestStream. The battle node has its own per-connection auth + // (encrypted viewerId query/header validated against the matched battle id), so the + // Steam handler has nothing to do here. Returning NoResult lets the request proceed + // unauthenticated to the WS endpoint. + if (Context.WebSockets.IsWebSocketRequest) + { + return AuthenticateResult.NoResult(); + } byte[] requestBytes; try {