How to get Steam web session cookie programatically

I’m currently trying to make a steam web api (the unofficial one which is partially documented here: https://github.com/Revadike/InternalSteamWebAPI/wiki) wrapper.
Like with every other unofficial api you have to get a sessionID to get access to certain api calls (for example selling items etc)

When actually implementing a login system tho there was nearly no documentation (also because steam just updated their login system with the new mobile app)

I analyzed the http traffic with a tool similar to burp suite. The website uses their own (official) api (api.steampowered.com) but kinda doesnt use the official methods?

(Instead of passing the params in the url it uses protobuf)
https://api.steampowered.com/IAuthenticationService/BeginAuthSessionViaCredentials/v1

------WebKitFormBoundarylRY65INKyJTRgG1i
Content-Disposition: form-data; name="input_protobuf_encoded"

EgtBbGJlcnQ0MjE2OBrYAlFPNFhxbWo0dGw3OVZ4L1IvR1A4eDVITU1yaHBBQldxSFU1NkhIMm5XK0Zsa0NJdVNIRm54dVdMR3drVmI2cXpZcmcyZVk0Q3AwOWZtQzdJcXRGSkxaWHhJbzNwM0tsdnVkNG1NcllaSWRaeUtZWkI4YlpjRW92d2llNFZWNyt1cnlick01MEd2M3RSSDYwUFJmSVpiQ3FCVGROaEpOZ0g5L3RRMlk1Q3doV21QT1BlOXhSdDVMTzdDdTgrR0cxSGlBSFRZbHZOMjQ0NWlBWldzY3ordCsvTU9xajZoOWhicmlpdVVoY1R0U29KUVdmclprNkpSRlA2dlo2ZDRHQ2VpelMwazdKZnQvQWdBWG1mQlVBN2tXOVVic2xIajR3NWFkcjU2S1FFbWJSSFc0THRHRVhvMVhybnRHL3RWVHRKUWl1VythUzh3aC9wNTVkZzVya1Rkdz09IJC49+WBCSgBOAFCBVN0b3JlSnMKb01vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMDYuMC4wLjAgU2FmYXJpLzUzNy4zNhAC
------WebKitFormBoundarylRY65INKyJTRgG1i--

If you wanted to make the same request according to documentations (here: https://steamapi.xpaw.me/#IAuthenticationService/BeginAuthSessionViaCredentials)

You would have to do something like this

POST https://api.steampowered.com/IAuthenticationService/BeginAuthSessionViaCredentials/v1?account_name=Albert68421&encrypted_password=...

I think the params are the same tho? So yeah as you can see everything is kind of a mess. Anyways I never worked with protobuf so i just went with the documented methods instead of the one the websites uses (they arent really documented tho because no documentation actually tells you how to continue after doing BeginAuthSessionViaCredentials)

For some reason steam makes their users encrypt the password via rsa. Also they give me the key in hex and string binary ("1010101") and want to recieve it in base64? I cant really find the correct way to do it so yeah.

From what i understand you have to do
https://api.steampowered.com/IAuthenticationService/GetPasswordRSAPublicKey/v1/?username=Albert48421

then you get something like this:

{"success":true,"publickey_mod":"a6009232c5e6651d9fe6daca66fd1e78f97fd15115b6db29e38f8865784b451d18d6378195f5cd6f5020fd775542759802e8c1940f2753d2d845e7e08c2b0cb7d28e21ce173c06abe182951242751bc2813d82077fa221a494288a3969e773b0a4d1ef6970d526075054bc8f5bba17fb67b6a729c3dcf232a0ae0440d32fc759ea999d5a4de87138d7c4e187998d92e6f93317f76d74e31f7359423f6bea17b2647305f731b507100e72ec09d0d9d3f5141fda87952fc42e28e3ec20c1f82aa4371cc9b4e0c96ca3bd548821c03c99ecd13e43af455f41ab678d02683a16b437080cf116cb74bdfd355e9ef2c2ecd3f81c54e6c541e6ecbea76a919dc4f9cb33","publickey_exp":"010001","timestamp":"309709350000","token_gid":"2a8a12860b39ef47"}

As i said i think the publickey_mod is hexadecimal (quite obvious) and the publickey_exp is binary because the binary -> decimal of 010001 is 17 which is commonly used for rsa because it has few 1s in binary repr (which makes rsa faster). It was actually hexadecimal which is 65537.

I use python rsa module and create the publickey like this in case that is my problem:

public_key = rsa.PublicKey(int(rsa_request["publickey_mod"], 16), int(rsa_request["publickey_exp"], 2))

then i rsa encrypt my password:

encrypted_pass = b64encode(rsa.encrypt(self.__login_data.password.encode("utf-8"), public_key)).decode("utf-8")

According to steam docs you are then supposed to use that encrypted password with
https://api.steampowered.com/IAuthenticationService/BeginAuthSessionViaCredentials/v1/

Which I did and i get something like this back

{'client_id': '163REDACTED397', 'request_id': 'mREDACTEDWQ==', 'interval': 5}

which doesnt look like the request failed until you try it again with a wrong password and get the exactly same result.

Here is the helpfull stuff i found:
https://github.com/DoctorMcKay/node-steam-session (I believe this is up-to-date but I’ve never used TypeScript and really dont understand the code.)
And also if you need a testing account with 2fa disabled use this one i just made it for testing:

Username: SOLVED
Password: SOLVED

Thanks for reading <3