Jump to content

/lobby/read endpoint shows all servers, including servers with a server cap of 1 and local servers and can be used to obtain IPs of all people which are hosting a server

Antonio32A

By Antonio32A

    • Pending

Note: This might be a feature, not a bug. If you consider it a bug, it will probably require a decent amount of work to be fixed.
Thanks a lot to https://github.com/IamFlea for help with this.

By sending a POST request to the server list endpoint you can fetch all servers in a region, if you do this 4 times for the regions eu, us, sing and china you can get the entire server list. The server list contains all servers, even the ones which should be hidden such as local only ones and to top of it off it also contains the host's IP address.

Showing all servers is fine but it still shows the host's IP address meaning that people can find servers of content creators or of any player and can abuse it in various ways. (DDoSing, getting their geolocation, etc.)

Also the lobby listings on https://d26ly0au0tyuy.cloudfront.net show server IPs as well, but it requires no authentication.
I don't see the point to this because you need a client token to connect to servers so this could also be a bug.

One final thing, are you able to tell me how to refresh client tokens (so they never expire if my code is running) or just grant me a permanent one?
I'm working on a Discord bot which will be able to show server information and will need to use the /lobby/read endpoint often to keep the server information up to date.

Steps to Reproduce

To fetch the entire list you have to make POST requests to 

https://lobby-$region.kleientertainment.com/lobby/read

$region is either eu, china, us or sing
your POST body should be 

{
     "__gameId": "DontStarveTogether",
     "__token": "your client token",
    "query": {}
}

Your response from the server will be in JSON format and will contain all the information about the server (IP address, rowID, name, players, mods, world, slaves/secondary servers, owner, etc.)

  • Like 1
  • Thanks 1
Go to bugs

User Feedback


Antonio32A

Oops, it seems like the title got a little messed up while I was writing this. Should be fixed now.

  • Like 1

Share this comment

Link to comment
Share on other sites
CarlZalph

I reported this back in a PM to Nome in 2017.  Basically don't abuse the non-supported functionality of the call was what I got out of it.  Klei logs everything.  I use this to quickly generate out current player pick rates for the sample times.

image.png.89c9d76322dc22966ad3db9ba6906171.png

 

For your token thing, ask Nome for a permanent token gen if you don't want to generate a new token with Steam auth every time.  I personally do Steam auth as it fits with what I've written already.  ISteamUser's GetAuthSessionTicket & login.kleientertainment.com/login/LoginViaSteam.

Edited by CarlZalph
  • Like 1
  • Thanks 2

Share this comment

Link to comment
Share on other sites
Antonio32A

Interesting, thank you for the response.

I might ask Nome for the permanent token but for now I wanna try out the manual authentication, is there any open source code which does that or is there any public documentation?
Manually extracting the token from game memory and keeping the game open is annoying.

It would be nice if they fixed this but it would probably require a redesign of the lobby API.
Maybe they could at least make it so the public lobbyListings endpoint doesn't show as much information so there is no room for abuse.

 

Edited by Antonio32A

Share this comment

Link to comment
Share on other sites


Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

×
×
  • Create New...