passport-steam-openid 1.0.3 → 1.1.0

package/README.md

@@ -59,7 +59,7 @@ Install using npm:
 ```
 npm install passport-steam-openid
 ```
-Released in early stage, library's api is subject to change.
+Library's API has been unchanged and stable for some time now. It will not change unless a breaking change is issued by steam (very unlikely).
 
 ## License
 This library is released under MIT license.

package/dist/strategy.d.ts

@@ -34,12 +34,22 @@ export declare class SteamOpenIdStrategy<TOptions extends SteamOpenIdStrategyOpt
      * optional callback, called when user is successfully authenticated
      */
     protected verify?: VerifyCallback<TUser>;
+    /**
+     * Optional setting for validating nonce time delay,
+     * in seconds.
+     *
+     * Measures time between nonce creation date and verification.
+     */
+    protected maxNonceTimeDelay: number | undefined;
     /**
      * @constructor
      *
      * @param options.returnURL where steam redirects after parameters are passed
      * @param options.profile if set, we will fetch user's profile from steam api
      * @param options.apiKey api key to fetch user profile, not used if profile is false
+     * @param options.maxNonceTimeDelay optional setting for validating nonce time delay,
+     *  this is just an extra security measure, it is not required nor recommended, but
+     *  might be extra layer of security you want to have.
      * @param verify optional callback, called when user is successfully authenticated
      */
     constructor(options: TOptions, verify?: VerifyCallback<TUser>);
@@ -64,6 +74,14 @@ export declare class SteamOpenIdStrategy<TOptions extends SteamOpenIdStrategyOpt
      * @throws {Error} Non-recoverable errors, such as query object missing.
      */
     handleRequest(req: any): Promise<TUser>;
+    /**
+     * Check if nonce date has expired against current delay setting,
+     * if no setting was set, then it is considered as not expired.
+     *
+     * @param nonceDate date when nonce was created
+     * @returns true, if nonce has expired and error should be thrown
+     */
+    protected hasNonceExpired(query: SteamOpenIdQuery): boolean;
     /**
      * Checks if error is retryable,
      * meaning user gets redirected to steam openid page.

package/dist/strategy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"strategy.d.ts","sourceRoot":"","sources":["../src/strategy.ts"],"names":[],"mappings":";AAAA,OAAW,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AACjD,OAAc,EAAE,aAAa,EAAE,MAAM,OAAO,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAUpC,OAAO,EACL,sBAAsB,EACtB,eAAe,EACf,gBAAgB,EAGhB,qCAAqC,EACrC,wCAAwC,EACxC,cAAc,EACf,MAAM,QAAQ,CAAC;AAEhB;;;;;;;GAOG;AACH,qBAAa,mBAAmB,CAC9B,QAAQ,SACJ,qCAAqC,GACrC,wCAAwC,EAC5C,KAAK,SACD,eAAe,GACf,sBAAsB,GAAG,QAAQ,SAAS,qCAAqC,GAC/E,sBAAsB,GACtB,eAAe,CACnB,SAAQ,QAAQ;IAChB;;OAEG;IACH,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAExC;;;;OAIG;IACH,SAAS,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAErC;;OAEG;IACH,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEnC;;OAEG;IACH,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAEpC;;OAEG;IACH,SAAS,CAAC,MAAM,CAAC,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC;IAEzC;;;;;;;OAOG;gBACS,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,cAAc,CAAC,KAAK,CAAC;IAW7D;;;;OAIG;IACmB,YAAY,CAAC,GAAG,EAAE,GAAG;IA+B3C;;;;;;;;;;;;;OAaG;IACU,aAAa,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC;IA8BpD;;;;;;;;OAQG;IACH,SAAS,CAAC,gBAAgB,CAAC,GAAG,EAAE,OAAO;IAOvC;;;;;;OAMG;IACH,SAAS,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,GAAG,cAAc;IAQ5C;;;;;;OAMG;IACH,SAAS,CAAC,YAAY,CAAC,KAAK,EAAE,cAAc;IAI5C;;;;OAIG;IACI,gBAAgB;IAYvB;;;;;;;OAOG;IACH,SAAS,CAAC,YAAY,CAAC,KAAK,EAAE,cAAc,GAAG,KAAK,IAAI,gBAAgB;IAcxE;;;;;;OAMG;IACH,SAAS,CAAC,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IASpD;;;;;;OAMG;IACH,SAAS,CAAC,oBAAoB,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAoBzE;;;;OAIG;IACH,SAAS,CAAC,8BAA8B,CAAC,KAAK,EAAE,gBAAgB;IAMhE;;;;;;OAMG;IACH,SAAS,CAAC,oBAAoB,CAAC,QAAQ,EAAE,GAAG;IAQ5C;;;;;OAKG;IACH,SAAS,CAAC,UAAU,CAAC,KAAK,EAAE,gBAAgB;IAM5C;;;;;;;;OAQG;cACa,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;IASxD;;;;;;;;;;OAUG;cACa,kBAAkB,CAChC,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,sBAAsB,CAAC;CAiCnC"}
+{"version":3,"file":"strategy.d.ts","sourceRoot":"","sources":["../src/strategy.ts"],"names":[],"mappings":";AAAA,OAAW,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AACjD,OAAc,EAAE,aAAa,EAAE,MAAM,OAAO,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAUpC,OAAO,EACL,sBAAsB,EACtB,eAAe,EACf,gBAAgB,EAGhB,qCAAqC,EACrC,wCAAwC,EACxC,cAAc,EACf,MAAM,QAAQ,CAAC;AAEhB;;;;;;;GAOG;AACH,qBAAa,mBAAmB,CAC9B,QAAQ,SACJ,qCAAqC,GACrC,wCAAwC,EAC5C,KAAK,SACD,eAAe,GACf,sBAAsB,GAAG,QAAQ,SAAS,qCAAqC,GAC/E,sBAAsB,GACtB,eAAe,CACnB,SAAQ,QAAQ;IAChB;;OAEG;IACH,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAExC;;;;OAIG;IACH,SAAS,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAErC;;OAEG;IACH,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEnC;;OAEG;IACH,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAEpC;;OAEG;IACH,SAAS,CAAC,MAAM,CAAC,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC;IAEzC;;;;;OAKG;IACH,SAAS,CAAC,iBAAiB,EAAE,MAAM,GAAG,SAAS,CAAC;IAEhD;;;;;;;;;;OAUG;gBACS,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,cAAc,CAAC,KAAK,CAAC;IAY7D;;;;OAIG;IACmB,YAAY,CAAC,GAAG,EAAE,GAAG;IA+B3C;;;;;;;;;;;;;OAaG;IACU,aAAa,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC;IAmCpD;;;;;;OAMG;IACH,SAAS,CAAC,eAAe,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO;IAW3D;;;;;;;;OAQG;IACH,SAAS,CAAC,gBAAgB,CAAC,GAAG,EAAE,OAAO;IAOvC;;;;;;OAMG;IACH,SAAS,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,GAAG,cAAc;IAQ5C;;;;;;OAMG;IACH,SAAS,CAAC,YAAY,CAAC,KAAK,EAAE,cAAc;IAI5C;;;;OAIG;IACI,gBAAgB;IAYvB;;;;;;;OAOG;IACH,SAAS,CAAC,YAAY,CAAC,KAAK,EAAE,cAAc,GAAG,KAAK,IAAI,gBAAgB;IAcxE;;;;;;OAMG;IACH,SAAS,CAAC,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IASpD;;;;;;OAMG;IACH,SAAS,CAAC,oBAAoB,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAoBzE;;;;OAIG;IACH,SAAS,CAAC,8BAA8B,CAAC,KAAK,EAAE,gBAAgB;IAMhE;;;;;;OAMG;IACH,SAAS,CAAC,oBAAoB,CAAC,QAAQ,EAAE,GAAG;IAQ5C;;;;;OAKG;IACH,SAAS,CAAC,UAAU,CAAC,KAAK,EAAE,gBAAgB;IAM5C;;;;;;;;OAQG;cACa,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;IASxD;;;;;;;;;;OAUG;cACa,kBAAkB,CAChC,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,sBAAsB,CAAC;CAiCnC"}

package/dist/strategy.js

@@ -23,6 +23,9 @@ class SteamOpenIdStrategy extends passport_1.Strategy {
      * @param options.returnURL where steam redirects after parameters are passed
      * @param options.profile if set, we will fetch user's profile from steam api
      * @param options.apiKey api key to fetch user profile, not used if profile is false
+     * @param options.maxNonceTimeDelay optional setting for validating nonce time delay,
+     *  this is just an extra security measure, it is not required nor recommended, but
+     *  might be extra layer of security you want to have.
      * @param verify optional callback, called when user is successfully authenticated
      */
     constructor(options, verify) {
@@ -31,6 +34,7 @@ class SteamOpenIdStrategy extends passport_1.Strategy {
         this.axios = axios_1.default.create();
         this.returnURL = options.returnURL;
         this.profile = options.profile;
+        this.maxNonceTimeDelay = options.maxNonceTimeDelay;
         if (options.profile)
             this.apiKey = options.apiKey;
         if (verify)
@@ -93,7 +97,9 @@ class SteamOpenIdStrategy extends passport_1.Strategy {
             if (!this.isQueryValid(query)) {
                 throw new error_1.SteamOpenIdError('Supplied query is invalid.', type_1.SteamOpenIdErrorType.InvalidQuery);
             }
-            // TODO: validate nonce time
+            if (this.hasNonceExpired(query)) {
+                throw new error_1.SteamOpenIdError('Nonce time delay was too big.', type_1.SteamOpenIdErrorType.NonceExpired);
+            }
             const valid = yield this.validateAgainstSteam(query);
             if (!valid) {
                 throw new error_1.SteamOpenIdError('Failed to validate query against steam.', type_1.SteamOpenIdErrorType.Unauthorized);
@@ -102,6 +108,22 @@ class SteamOpenIdStrategy extends passport_1.Strategy {
             return yield this.getUser(steamId);
         });
     }
+    /**
+     * Check if nonce date has expired against current delay setting,
+     * if no setting was set, then it is considered as not expired.
+     *
+     * @param nonceDate date when nonce was created
+     * @returns true, if nonce has expired and error should be thrown
+     */
+    hasNonceExpired(query) {
+        if (typeof this.maxNonceTimeDelay == 'undefined') {
+            return false;
+        }
+        const nonceDate = new Date(query['openid.response_nonce'].slice(0, 20));
+        const nonceSeconds = Math.floor(nonceDate.getTime() / 1000);
+        const nowSeconds = Math.floor(Date.now() / 1000);
+        return nowSeconds - nonceSeconds > this.maxNonceTimeDelay;
+    }
     /**
      * Checks if error is retryable,
      * meaning user gets redirected to steam openid page.

package/dist/type.d.ts

@@ -1,6 +1,16 @@
 import { DoneCallback } from 'passport';
 export type BaseSteamOpenIdStrategyOptions = {
     returnURL: string;
+    /**
+     * Maximum time delay between the nonce creation and the nonce verification,
+     * in seconds.
+     *
+     * nonce includes a timestamp we can validate against the current time,
+     * while the steam server validates this as well, you might want to
+     * set maximum number of seconds between the nonce creation and the nonce
+     * verification.
+     */
+    maxNonceTimeDelay?: number;
 };
 export type SteamOpenIdStrategyOptionsWithProfile = {
     profile: true;
@@ -31,7 +41,11 @@ export declare enum SteamOpenIdErrorType {
     /**
      * SteamId is not valid.
      */
-    InvalidSteamId = 3
+    InvalidSteamId = 3,
+    /**
+     * Nonce has expired.
+     */
+    NonceExpired = 4
 }
 /** When profile is not used, we just send a steamid. */
 export type SteamOpenIdUser = {

package/dist/type.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"type.d.ts","sourceRoot":"","sources":["../src/type.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAExC,MAAM,MAAM,8BAA8B,GAAG;IAC3C,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,qCAAqC,GAAG;IAClD,OAAO,EAAE,IAAI,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,8BAA8B,CAAC;AAEnC,MAAM,MAAM,wCAAwC,GAAG;IACrD,OAAO,EAAE,KAAK,CAAC;CAChB,GAAG,8BAA8B,CAAC;AAEnC,MAAM,MAAM,0BAA0B,GAClC,qCAAqC,GACrC,wCAAwC,CAAC;AAE7C;;;;GAIG;AACH,oBAAY,oBAAoB;IAC9B;;OAEG;IACH,WAAW,IAAI;IACf;;OAEG;IACH,YAAY,IAAI;IAChB;;OAEG;IACH,YAAY,IAAI;IAChB;;OAEG;IACH,cAAc,IAAI;CACnB;AAED,wDAAwD;AACxD,MAAM,MAAM,eAAe,GAAG;IAC5B,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,+BAA+B;AAC/B,MAAM,MAAM,0BAA0B,GAAG;IACvC,QAAQ,EAAE;QACR,OAAO,EAAE,sBAAsB,EAAE,CAAC;KACnC,CAAC;CACH,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,wBAAwB,EAAE,MAAM,CAAC;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,cAAc,CACxB,KAAK,SAAS,eAAe,GAAG,sBAAsB,IACpD,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,KAAK,GAAG,CAAC;AAE9E,MAAM,MAAM,gBAAgB,GAAG;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,uBAAuB,EAAE,MAAM,CAAC;IAChC,qBAAqB,EAAE,MAAM,CAAC;IAC9B,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC"}
+{"version":3,"file":"type.d.ts","sourceRoot":"","sources":["../src/type.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAExC,MAAM,MAAM,8BAA8B,GAAG;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;;;OAQG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,qCAAqC,GAAG;IAClD,OAAO,EAAE,IAAI,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,8BAA8B,CAAC;AAEnC,MAAM,MAAM,wCAAwC,GAAG;IACrD,OAAO,EAAE,KAAK,CAAC;CAChB,GAAG,8BAA8B,CAAC;AAEnC,MAAM,MAAM,0BAA0B,GAClC,qCAAqC,GACrC,wCAAwC,CAAC;AAE7C;;;;GAIG;AACH,oBAAY,oBAAoB;IAC9B;;OAEG;IACH,WAAW,IAAI;IACf;;OAEG;IACH,YAAY,IAAI;IAChB;;OAEG;IACH,YAAY,IAAI;IAChB;;OAEG;IACH,cAAc,IAAI;IAClB;;OAEG;IACH,YAAY,IAAI;CACjB;AAED,wDAAwD;AACxD,MAAM,MAAM,eAAe,GAAG;IAC5B,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,+BAA+B;AAC/B,MAAM,MAAM,0BAA0B,GAAG;IACvC,QAAQ,EAAE;QACR,OAAO,EAAE,sBAAsB,EAAE,CAAC;KACnC,CAAC;CACH,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,wBAAwB,EAAE,MAAM,CAAC;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,cAAc,CACxB,KAAK,SAAS,eAAe,GAAG,sBAAsB,IACpD,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,KAAK,GAAG,CAAC;AAE9E,MAAM,MAAM,gBAAgB,GAAG;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,uBAAuB,EAAE,MAAM,CAAC;IAChC,qBAAqB,EAAE,MAAM,CAAC;IAC9B,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC"}

package/dist/type.js

@@ -24,4 +24,8 @@ var SteamOpenIdErrorType;
      * SteamId is not valid.
      */
     SteamOpenIdErrorType[SteamOpenIdErrorType["InvalidSteamId"] = 3] = "InvalidSteamId";
+    /**
+     * Nonce has expired.
+     */
+    SteamOpenIdErrorType[SteamOpenIdErrorType["NonceExpired"] = 4] = "NonceExpired";
 })(SteamOpenIdErrorType || (exports.SteamOpenIdErrorType = SteamOpenIdErrorType = {}));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "passport-steam-openid",
-  "version": "1.0.3",
+  "version": "1.1.0",
   "description": "Passport strategy for authenticating with steam openid without the use of 3rd party openid packages.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/sample/package-lock.json

@@ -10,7 +10,7 @@
       "license": "MIT",
       "dependencies": {
         "dotenv": "^16.3.1",
-        "express": "^4.18.2",
+        "express": "^4.19.2",
         "express-session": "^1.17.3",
         "passport": "^0.6.0",
         "passport-steam-openid": "^1.0.0"
@@ -710,6 +710,29 @@
       "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
       "dev": true
     },
+    "node_modules/body-parser": {
+      "version": "1.20.2",
+      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.2.tgz",
+      "integrity": "sha512-ml9pReCu3M61kGlqoTm2umSXTlRTuGTx0bfYj+uIUKKYycG5NtSbeetV3faSU6R7ajOPw0g/J1PvK4qNy7s5bA==",
+      "dependencies": {
+        "bytes": "3.1.2",
+        "content-type": "~1.0.5",
+        "debug": "2.6.9",
+        "depd": "2.0.0",
+        "destroy": "1.2.0",
+        "http-errors": "2.0.0",
+        "iconv-lite": "0.4.24",
+        "on-finished": "2.4.1",
+        "qs": "6.11.0",
+        "raw-body": "2.5.2",
+        "type-is": "~1.6.18",
+        "unpipe": "1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.8",
+        "npm": "1.2.8000 || >= 1.4.16"
+      }
+    },
     "node_modules/brace-expansion": {
       "version": "1.1.11",
       "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.11.tgz",
@@ -741,12 +764,18 @@
       }
     },
     "node_modules/call-bind": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/call-bind/-/call-bind-1.0.2.tgz",
-      "integrity": "sha512-7O+FbCihrB5WGbFYesctwmTKae6rOiIzmz1icreWJ+0aA7LJfuqhEso2T9ncpcFtzMQtzXf2QGGueWJGTYsqrA==",
+      "version": "1.0.7",
+      "resolved": "https://registry.npmjs.org/call-bind/-/call-bind-1.0.7.tgz",
+      "integrity": "sha512-GHTSNSYICQ7scH7sZ+M2rFopRoLh8t2bLSW6BbgrtLsahOIB5iyAVJf9GjWK3cYTDaMj4XdBpM1cA6pIS0Kv2w==",
       "dependencies": {
-        "function-bind": "^1.1.1",
-        "get-intrinsic": "^1.0.2"
+        "es-define-property": "^1.0.0",
+        "es-errors": "^1.3.0",
+        "function-bind": "^1.1.2",
+        "get-intrinsic": "^1.2.4",
+        "set-function-length": "^1.2.1"
+      },
+      "engines": {
+        "node": ">= 0.4"
       },
       "funding": {
         "url": "https://github.com/sponsors/ljharb"
@@ -832,9 +861,9 @@
       }
     },
     "node_modules/cookie": {
-      "version": "0.5.0",
-      "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.5.0.tgz",
-      "integrity": "sha512-YZ3GUyn/o8gfKJlnlX7g7xq4gyO6OSuhGPKaaGssGB2qgDUS0gPgtTvoyZLTt9Ab6dC4hfc9dV5arkvc/OCmrw==",
+      "version": "0.6.0",
+      "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.6.0.tgz",
+      "integrity": "sha512-U71cyTamuh1CRNCfpGY6to28lxvNwPG4Guz/EVjgf3Jmzv0vlDp1atT9eS5dDjMYHucpHbWns6Lwf3BKz6svdw==",
       "engines": {
         "node": ">= 0.6"
       }
@@ -872,6 +901,22 @@
       "integrity": "sha512-oIPzksmTg4/MriiaYGO+okXDT7ztn/w3Eptv/+gSIdMdKsJo0u4CfYNFJPy+4SKMuCqGw2wxnA+URMg3t8a/bQ==",
       "dev": true
     },
+    "node_modules/define-data-property": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/define-data-property/-/define-data-property-1.1.4.tgz",
+      "integrity": "sha512-rBMvIzlpA8v6E+SJZoo++HAYqsLrkg7MSfIinMPFhmkorw7X+dOXVJQs+QT69zGkzMyfDnIMN2Wid1+NbL3T+A==",
+      "dependencies": {
+        "es-define-property": "^1.0.0",
+        "es-errors": "^1.3.0",
+        "gopd": "^1.0.1"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
     "node_modules/delayed-stream": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/delayed-stream/-/delayed-stream-1.0.0.tgz",
@@ -945,6 +990,25 @@
         "node": ">= 0.8"
       }
     },
+    "node_modules/es-define-property": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/es-define-property/-/es-define-property-1.0.0.tgz",
+      "integrity": "sha512-jxayLKShrEqqzJ0eumQbVhTYQM27CfT1T35+gCgDFoL82JLsXqTJ76zv6A0YLOgEnLUMvLzsDsGIrl8NFpT2gQ==",
+      "dependencies": {
+        "get-intrinsic": "^1.2.4"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/es-errors": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/es-errors/-/es-errors-1.3.0.tgz",
+      "integrity": "sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
     "node_modules/escape-html": {
       "version": "1.0.3",
       "resolved": "https://registry.npmjs.org/escape-html/-/escape-html-1.0.3.tgz",
@@ -1222,16 +1286,16 @@
       }
     },
     "node_modules/express": {
-      "version": "4.18.2",
-      "resolved": "https://registry.npmjs.org/express/-/express-4.18.2.tgz",
-      "integrity": "sha512-5/PsL6iGPdfQ/lKM1UuielYgv3BUoJfz1aUwU9vHZ+J7gyvwdQXFEBIEIaxeGf0GIcreATNyBExtalisDbuMqQ==",
+      "version": "4.19.2",
+      "resolved": "https://registry.npmjs.org/express/-/express-4.19.2.tgz",
+      "integrity": "sha512-5T6nhjsT+EOMzuck8JjBHARTHfMht0POzlA60WV2pMD3gyXw2LZnZ+ueGdNxG+0calOJcWKbpFcuzLZ91YWq9Q==",
       "dependencies": {
         "accepts": "~1.3.8",
         "array-flatten": "1.1.1",
-        "body-parser": "1.20.1",
+        "body-parser": "1.20.2",
         "content-disposition": "0.5.4",
         "content-type": "~1.0.4",
-        "cookie": "0.5.0",
+        "cookie": "0.6.0",
         "cookie-signature": "1.0.6",
         "debug": "2.6.9",
         "depd": "2.0.0",
@@ -1288,57 +1352,6 @@
         "node": ">= 0.6"
       }
     },
-    "node_modules/express/node_modules/body-parser": {
-      "version": "1.20.1",
-      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.1.tgz",
-      "integrity": "sha512-jWi7abTbYwajOytWCQc37VulmWiRae5RyTpaCyDcS5/lMdtwSz5lOpDE67srw/HYe35f1z3fDQw+3txg7gNtWw==",
-      "dependencies": {
-        "bytes": "3.1.2",
-        "content-type": "~1.0.4",
-        "debug": "2.6.9",
-        "depd": "2.0.0",
-        "destroy": "1.2.0",
-        "http-errors": "2.0.0",
-        "iconv-lite": "0.4.24",
-        "on-finished": "2.4.1",
-        "qs": "6.11.0",
-        "raw-body": "2.5.1",
-        "type-is": "~1.6.18",
-        "unpipe": "1.0.0"
-      },
-      "engines": {
-        "node": ">= 0.8",
-        "npm": "1.2.8000 || >= 1.4.16"
-      }
-    },
-    "node_modules/express/node_modules/qs": {
-      "version": "6.11.0",
-      "resolved": "https://registry.npmjs.org/qs/-/qs-6.11.0.tgz",
-      "integrity": "sha512-MvjoMCJwEarSbUYk5O+nmoSzSutSsTwF85zcHPQ9OrlFoZOYIjaqBAJIqIXjptyD5vThxGq52Xu/MaJzRkIk4Q==",
-      "dependencies": {
-        "side-channel": "^1.0.4"
-      },
-      "engines": {
-        "node": ">=0.6"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/express/node_modules/raw-body": {
-      "version": "2.5.1",
-      "resolved": "https://registry.npmjs.org/raw-body/-/raw-body-2.5.1.tgz",
-      "integrity": "sha512-qqJBtEyVgS0ZmPGdCFPWJ3FreoqvG4MVQln/kCgF7Olq95IbOp0/BWyMwbdtn4VTvkM8Y7khCQ2Xgk/tcrCXig==",
-      "dependencies": {
-        "bytes": "3.1.2",
-        "http-errors": "2.0.0",
-        "iconv-lite": "0.4.24",
-        "unpipe": "1.0.0"
-      },
-      "engines": {
-        "node": ">= 0.8"
-      }
-    },
     "node_modules/fast-deep-equal": {
       "version": "3.1.3",
       "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
@@ -1477,9 +1490,9 @@
       "dev": true
     },
     "node_modules/follow-redirects": {
-      "version": "1.15.4",
-      "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.4.tgz",
-      "integrity": "sha512-Cr4D/5wlrb0z9dgERpUL3LrmPKVDsETIJhaCMeDfuFYcqa5bldGV6wBsAN6X/vxlXQtFBMrXdXxdL8CbDTGniw==",
+      "version": "1.15.6",
+      "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.6.tgz",
+      "integrity": "sha512-wWN62YITEaOpSK584EZXJafH1AGpO8RVgElfkuXbTOrPX4fIfOyEpW/CsiNd8JdYrAoOvafRTOEnvsO++qCqFA==",
       "funding": [
         {
           "type": "individual",
@@ -1531,19 +1544,26 @@
       "dev": true
     },
     "node_modules/function-bind": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/function-bind/-/function-bind-1.1.1.tgz",
-      "integrity": "sha512-yIovAzMX49sF8Yl58fSCWJ5svSLuaibPxXQJFLmBObTuCr0Mf1KiPopGM9NiFjiYBCbfaa2Fh6breQ6ANVTI0A=="
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/function-bind/-/function-bind-1.1.2.tgz",
+      "integrity": "sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==",
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
     },
     "node_modules/get-intrinsic": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.2.1.tgz",
-      "integrity": "sha512-2DcsyfABl+gVHEfCOaTrWgyt+tb6MSEGmKq+kI5HwLbIYgjgmMcV8KQ41uaKz1xxUcn9tJtgFbQUEVcEbd0FYw==",
+      "version": "1.2.4",
+      "resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.2.4.tgz",
+      "integrity": "sha512-5uYhsJH8VJBTv7oslg4BznJYhDoRI6waYCxMmCdnTrcCrHA/fCFKoTFz2JKKE0HdDFUF7/oQuhzumXJK7paBRQ==",
       "dependencies": {
-        "function-bind": "^1.1.1",
-        "has": "^1.0.3",
+        "es-errors": "^1.3.0",
+        "function-bind": "^1.1.2",
         "has-proto": "^1.0.1",
-        "has-symbols": "^1.0.3"
+        "has-symbols": "^1.0.3",
+        "hasown": "^2.0.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
       },
       "funding": {
         "url": "https://github.com/sponsors/ljharb"
@@ -1616,6 +1636,17 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/gopd": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/gopd/-/gopd-1.0.1.tgz",
+      "integrity": "sha512-d65bNlIadxvpb/A2abVdlqKqV563juRnZ1Wtk6s1sIR8uNsXR70xqIzVqxVf1eTqDunwT2MkczEeaezCKTZhwA==",
+      "dependencies": {
+        "get-intrinsic": "^1.1.3"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
     "node_modules/grapheme-splitter": {
       "version": "1.0.4",
       "resolved": "https://registry.npmjs.org/grapheme-splitter/-/grapheme-splitter-1.0.4.tgz",
@@ -1628,17 +1659,6 @@
       "integrity": "sha512-EtKwoO6kxCL9WO5xipiHTZlSzBm7WLT627TqC/uVRd0HKmq8NXyebnNYxDoBi7wt8eTWrUrKXCOVaFq9x1kgag==",
       "dev": true
     },
-    "node_modules/has": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/has/-/has-1.0.3.tgz",
-      "integrity": "sha512-f2dvO0VU6Oej7RkWJGrehjbzMAjFp5/VKPp5tTpWIV4JHHZK1/BxbFRtf/siA2SWTe09caDmVtYYzWEIbBS4zw==",
-      "dependencies": {
-        "function-bind": "^1.1.1"
-      },
-      "engines": {
-        "node": ">= 0.4.0"
-      }
-    },
     "node_modules/has-flag": {
       "version": "4.0.0",
       "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
@@ -1648,10 +1668,21 @@
         "node": ">=8"
       }
     },
+    "node_modules/has-property-descriptors": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/has-property-descriptors/-/has-property-descriptors-1.0.2.tgz",
+      "integrity": "sha512-55JNKuIW+vq4Ke1BjOTjM2YctQIvCT7GFzHwmfZPGo5wnrgkid0YQtnAleFSqumZm4az3n2BS+erby5ipJdgrg==",
+      "dependencies": {
+        "es-define-property": "^1.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
     "node_modules/has-proto": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/has-proto/-/has-proto-1.0.1.tgz",
-      "integrity": "sha512-7qE+iP+O+bgF9clE5+UoBFzE65mlBiVj3tKCrlNQ0Ogwm0BjpT/gK4SlLYDMybDh5I3TCTKnPPa0oMG7JDYrhg==",
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/has-proto/-/has-proto-1.0.3.tgz",
+      "integrity": "sha512-SJ1amZAJUiZS+PhsVLf5tGydlaVB8EdFpaSO4gmiUKUOxk8qzn5AIy4ZeJUmh22znIdk/uMAUT2pl3FxzVUH+Q==",
       "engines": {
         "node": ">= 0.4"
       },
@@ -1670,6 +1701,17 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/hasown": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.2.tgz",
+      "integrity": "sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ==",
+      "dependencies": {
+        "function-bind": "^1.1.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
     "node_modules/http-errors": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-2.0.0.tgz",
@@ -1979,9 +2021,9 @@
       }
     },
     "node_modules/object-inspect": {
-      "version": "1.12.3",
-      "resolved": "https://registry.npmjs.org/object-inspect/-/object-inspect-1.12.3.tgz",
-      "integrity": "sha512-geUvdk7c+eizMNUDkRpW1wJwgfOiOeHbxBR/hLXK1aT6zmVSO0jsQcs7fj6MGw89jC/cjGfLcNOrtMYtGqm81g==",
+      "version": "1.13.1",
+      "resolved": "https://registry.npmjs.org/object-inspect/-/object-inspect-1.13.1.tgz",
+      "integrity": "sha512-5qoj1RUiKOMsCCNLV1CBiPYE10sziTsnmNxkAI/rZhiD63CF7IqdFGC/XzjWjpSgLf0LxXX3bDFIh0E18f6UhQ==",
       "funding": {
         "url": "https://github.com/sponsors/ljharb"
       }
@@ -2236,6 +2278,20 @@
         "node": ">=6"
       }
     },
+    "node_modules/qs": {
+      "version": "6.11.0",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.11.0.tgz",
+      "integrity": "sha512-MvjoMCJwEarSbUYk5O+nmoSzSutSsTwF85zcHPQ9OrlFoZOYIjaqBAJIqIXjptyD5vThxGq52Xu/MaJzRkIk4Q==",
+      "dependencies": {
+        "side-channel": "^1.0.4"
+      },
+      "engines": {
+        "node": ">=0.6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
     "node_modules/queue-microtask": {
       "version": "1.2.3",
       "resolved": "https://registry.npmjs.org/queue-microtask/-/queue-microtask-1.2.3.tgz",
@@ -2272,6 +2328,20 @@
         "node": ">= 0.6"
       }
     },
+    "node_modules/raw-body": {
+      "version": "2.5.2",
+      "resolved": "https://registry.npmjs.org/raw-body/-/raw-body-2.5.2.tgz",
+      "integrity": "sha512-8zGqypfENjCIqGhgXToC8aB2r7YrBX+AQAfIPs/Mlk+BtPTztOvTS01NRW/3Eh60J+a48lt8qsCzirQ6loCVfA==",
+      "dependencies": {
+        "bytes": "3.1.2",
+        "http-errors": "2.0.0",
+        "iconv-lite": "0.4.24",
+        "unpipe": "1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
     "node_modules/resolve-from": {
       "version": "4.0.0",
       "resolved": "https://registry.npmjs.org/resolve-from/-/resolve-from-4.0.0.tgz",
@@ -2410,6 +2480,22 @@
         "node": ">= 0.8.0"
       }
     },
+    "node_modules/set-function-length": {
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/set-function-length/-/set-function-length-1.2.2.tgz",
+      "integrity": "sha512-pgRc4hJ4/sNjWCSS9AmnS40x3bNMDTknHgL5UaMBTMyJnU90EgWh1Rz+MC9eFu4BuN/UwZjKQuY/1v3rM7HMfg==",
+      "dependencies": {
+        "define-data-property": "^1.1.4",
+        "es-errors": "^1.3.0",
+        "function-bind": "^1.1.2",
+        "get-intrinsic": "^1.2.4",
+        "gopd": "^1.0.1",
+        "has-property-descriptors": "^1.0.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
     "node_modules/setprototypeof": {
       "version": "1.2.0",
       "resolved": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.2.0.tgz",
@@ -2437,13 +2523,17 @@
       }
     },
     "node_modules/side-channel": {
-      "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.0.4.tgz",
-      "integrity": "sha512-q5XPytqFEIKHkGdiMIrY10mvLRvnQh42/+GoBlFW3b2LXLE2xxJpZFdm94we0BaoV3RwJyGqg5wS7epxTv0Zvw==",
+      "version": "1.0.6",
+      "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.0.6.tgz",
+      "integrity": "sha512-fDW/EZ6Q9RiO8eFG8Hj+7u/oW+XrPTIChwCOM2+th2A6OblDtYYIpve9m+KvI9Z4C9qSEXlaGR6bTEYHReuglA==",
       "dependencies": {
-        "call-bind": "^1.0.0",
-        "get-intrinsic": "^1.0.2",
-        "object-inspect": "^1.9.0"
+        "call-bind": "^1.0.7",
+        "es-errors": "^1.3.0",
+        "get-intrinsic": "^1.2.4",
+        "object-inspect": "^1.13.1"
+      },
+      "engines": {
+        "node": ">= 0.4"
       },
       "funding": {
         "url": "https://github.com/sponsors/ljharb"

package/sample/package.json

@@ -13,7 +13,7 @@
   "license": "MIT",
   "dependencies": {
     "dotenv": "^16.3.1",
-    "express": "^4.18.2",
+    "express": "^4.19.2",
     "express-session": "^1.17.3",
     "passport": "^0.6.0",
     "passport-steam-openid": "^1.0.0"

package/src/strategy.ts

@@ -66,12 +66,23 @@ export class SteamOpenIdStrategy<
    */
   protected verify?: VerifyCallback<TUser>;
 
+  /**
+   * Optional setting for validating nonce time delay,
+   * in seconds.
+   *
+   * Measures time between nonce creation date and verification.
+   */
+  protected maxNonceTimeDelay: number | undefined;
+
   /**
    * @constructor
    *
    * @param options.returnURL where steam redirects after parameters are passed
    * @param options.profile if set, we will fetch user's profile from steam api
    * @param options.apiKey api key to fetch user profile, not used if profile is false
+   * @param options.maxNonceTimeDelay optional setting for validating nonce time delay,
+   *  this is just an extra security measure, it is not required nor recommended, but
+   *  might be extra layer of security you want to have.
    * @param verify optional callback, called when user is successfully authenticated
    */
   constructor(options: TOptions, verify?: VerifyCallback<TUser>) {
@@ -81,6 +92,7 @@ export class SteamOpenIdStrategy<
     this.axios = axios.create();
     this.returnURL = options.returnURL;
     this.profile = options.profile;
+    this.maxNonceTimeDelay = options.maxNonceTimeDelay;
     if (options.profile) this.apiKey = options.apiKey;
     if (verify) this.verify = verify;
   }
@@ -151,7 +163,12 @@ export class SteamOpenIdStrategy<
       );
     }
 
-    // TODO: validate nonce time
+    if (this.hasNonceExpired(query)) {
+      throw new SteamOpenIdError(
+        'Nonce time delay was too big.',
+        SteamOpenIdErrorType.NonceExpired,
+      );
+    }
 
     const valid = await this.validateAgainstSteam(query);
     if (!valid) {
@@ -165,6 +182,24 @@ export class SteamOpenIdStrategy<
     return await this.getUser(steamId);
   }
 
+  /**
+   * Check if nonce date has expired against current delay setting,
+   * if no setting was set, then it is considered as not expired.
+   *
+   * @param nonceDate date when nonce was created
+   * @returns true, if nonce has expired and error should be thrown
+   */
+  protected hasNonceExpired(query: SteamOpenIdQuery): boolean {
+    if (typeof this.maxNonceTimeDelay == 'undefined') {
+      return false;
+    }
+
+    const nonceDate = new Date(query['openid.response_nonce'].slice(0, 20));
+    const nonceSeconds = Math.floor(nonceDate.getTime() / 1000);
+    const nowSeconds = Math.floor(Date.now() / 1000);
+    return nowSeconds - nonceSeconds > this.maxNonceTimeDelay;
+  }
+
   /**
    * Checks if error is retryable,
    * meaning user gets redirected to steam openid page.

package/src/type.ts

@@ -2,6 +2,16 @@ import { DoneCallback } from 'passport';
 
 export type BaseSteamOpenIdStrategyOptions = {
   returnURL: string;
+  /**
+   * Maximum time delay between the nonce creation and the nonce verification,
+   * in seconds.
+   *
+   * nonce includes a timestamp we can validate against the current time,
+   * while the steam server validates this as well, you might want to
+   * set maximum number of seconds between the nonce creation and the nonce
+   * verification.
+   */
+  maxNonceTimeDelay?: number;
 };
 
 export type SteamOpenIdStrategyOptionsWithProfile = {
@@ -39,6 +49,10 @@ export enum SteamOpenIdErrorType {
    * SteamId is not valid.
    */
   InvalidSteamId = 3,
+  /**
+   * Nonce has expired.
+   */
+  NonceExpired = 4,
 }
 
 /** When profile is not used, we just send a steamid. */

package/test/setup/data.ts

@@ -1,12 +1,18 @@
-import { VALID_NONCE, VALID_OPENID_ENDPOINT } from '../../src';
+import {
+  SteamOpenIdQuery,
+  VALID_NONCE,
+  VALID_OPENID_ENDPOINT,
+} from '../../src';
 
 export const RETURN_URL = '/auth/steam';
 
+export const getISODate = (date: Date) => date.toISOString().split('.')[0] + 'Z';
+
 export const query: {
-  properties: Record<string, string>;
-  get(): Record<string, string>;
-  change(change: Record<string, string>): Record<string, string>;
-  remove(property: string): Record<string, string>;
+  properties: SteamOpenIdQuery;
+  get(): SteamOpenIdQuery;
+  change(change: Partial<SteamOpenIdQuery>): SteamOpenIdQuery;
+  remove(property: keyof SteamOpenIdQuery): SteamOpenIdQuery;
 } = {
   /**
    * Valid query properties
@@ -18,22 +24,22 @@ export const query: {
     'openid.claimed_id': `https://steamcommunity.com/openid/id/76561197960435530`,
     'openid.return_to': RETURN_URL,
     'openid.op_endpoint': VALID_OPENID_ENDPOINT,
-    'openid.response_nonce': `${new Date().toJSON()}8df86bac92ad1addaf3735a5aabdc6e2a7`,
+    'openid.response_nonce': `${getISODate(new Date())}8df86bac92ad1addaf3735a5aabdc6e2a7`,
     'openid.assoc_handle': '1234567890',
     'openid.signed':
       'signed,op_endpoint,claimed_id,identity,return_to,response_nonce,assoc_handle',
     'openid.sig': 'dc6e2a79de2c6aceac495ad5f4c6b6e0bfe30',
   },
 
-  get() {
+  get(): SteamOpenIdQuery {
     return { ...this.properties };
   },
 
-  change(change: Record<string, string>) {
+  change(change: Partial<SteamOpenIdQuery>): SteamOpenIdQuery {
     return { ...this.get(), ...change };
   },
 
-  remove(property: string) {
+  remove(property: keyof SteamOpenIdQuery): SteamOpenIdQuery {
     const properties = this.get();
     delete properties[property];
     return properties;

package/test/strategy.ts

@@ -15,7 +15,7 @@ import {
   VALID_OPENID_ENDPOINT,
   PLAYER_SUMMARY_URL,
 } from '../src';
-import { RETURN_URL, query } from './setup/data';
+import { RETURN_URL, getISODate, query } from './setup/data';
 
 chai.use(chaiAsPromised);
 
@@ -214,12 +214,14 @@ describe('SteamOpenIdStrategy Unit Test', () => {
     let getQueryStub: sinon.SinonStub;
     let hasAuthQueryStub: sinon.SinonStub;
     let isQueryValidStub: sinon.SinonStub;
+    let hasNonceExpiredStub: sinon.SinonStub;
     let validateAgainstSteamStub: sinon.SinonStub;
 
     beforeEach(() => {
       getQueryStub = sinon.stub(strategy as any, 'getQuery').returns(query);
       hasAuthQueryStub = sinon.stub(strategy as any, 'hasAuthQuery');
       isQueryValidStub = sinon.stub(strategy as any, 'isQueryValid');
+      hasNonceExpiredStub = sinon.stub(strategy as any, 'hasNonceExpired');
       validateAgainstSteamStub = sinon.stub(
         strategy as any,
         'validateAgainstSteam',
@@ -237,6 +239,7 @@ describe('SteamOpenIdStrategy Unit Test', () => {
       hasAuthQueryStub.returns(true);
       isQueryValidStub.returns(true);
       validateAgainstSteamStub.resolves(true);
+      hasNonceExpiredStub.returns(false);
 
       const steamid = '76561197960435530';
       const user = { steamid: '76561197960435530' };
@@ -253,6 +256,8 @@ describe('SteamOpenIdStrategy Unit Test', () => {
       expect(getUserStub.calledWithExactly(steamid)).equal(true);
       expect(isQueryValidStub.callCount).equal(1);
       expect(isQueryValidStub.calledWithExactly(query)).equal(true);
+      expect(hasNonceExpiredStub.callCount).equal(1);
+      expect(hasNonceExpiredStub.calledWithExactly(query)).equal(true);
       expect(validateAgainstSteamStub.callCount).equal(1);
       expect(validateAgainstSteamStub.calledWithExactly(query)).equal(true);
     });
@@ -269,6 +274,9 @@ describe('SteamOpenIdStrategy Unit Test', () => {
 
       expect(err).to.be.instanceOf(SteamOpenIdError);
       expect(err).to.have.property('code', SteamOpenIdErrorType.InvalidMode);
+      expect(isQueryValidStub.callCount).equal(0);
+      expect(hasNonceExpiredStub.callCount).equal(0);
+      expect(validateAgainstSteamStub.callCount).equal(0);
     });
 
     it('Query is invalid', async () => {
@@ -286,11 +294,35 @@ describe('SteamOpenIdStrategy Unit Test', () => {
       expect(err).to.have.property('code', SteamOpenIdErrorType.InvalidQuery);
       expect(isQueryValidStub.callCount).equal(1);
       expect(isQueryValidStub.calledWithExactly(query)).equal(true);
+      expect(hasNonceExpiredStub.callCount).equal(0);
+      expect(validateAgainstSteamStub.callCount).equal(0);
+    });
+
+    it('Nonce has expired', async () => {
+      hasAuthQueryStub.returns(true);
+      isQueryValidStub.returns(true);
+      hasNonceExpiredStub.returns(true);
+
+      let err: any;
+      try {
+        await strategy.handleRequest(request);
+      } catch (e) {
+        err = e;
+      }
+
+      expect(err).to.be.instanceOf(SteamOpenIdError);
+      expect(err).to.have.property('code', SteamOpenIdErrorType.NonceExpired);
+      expect(isQueryValidStub.callCount).equal(1);
+      expect(isQueryValidStub.calledWithExactly(query)).equal(true);
+      expect(hasNonceExpiredStub.callCount).equal(1);
+      expect(hasNonceExpiredStub.calledWithExactly(query)).equal(true);
+      expect(validateAgainstSteamStub.callCount).equal(0);
     });
 
     it('Steam rejects this authentication request', async () => {
       hasAuthQueryStub.returns(true);
       isQueryValidStub.returns(true);
+      hasNonceExpiredStub.returns(false);
       validateAgainstSteamStub.resolves(false);
 
       let err: any;
@@ -304,6 +336,8 @@ describe('SteamOpenIdStrategy Unit Test', () => {
       expect(err).to.have.property('code', SteamOpenIdErrorType.Unauthorized);
       expect(isQueryValidStub.callCount).equal(1);
       expect(isQueryValidStub.calledWithExactly(query)).equal(true);
+      expect(hasNonceExpiredStub.callCount).equal(1);
+      expect(hasNonceExpiredStub.calledWithExactly(query)).equal(true);
       expect(validateAgainstSteamStub.callCount).equal(1);
       expect(validateAgainstSteamStub.calledWithExactly(query)).equal(true);
     });
@@ -722,4 +756,40 @@ describe('SteamOpenIdStrategy Unit Test', () => {
       expect(err).to.have.property('code', SteamOpenIdErrorType.InvalidSteamId);
     });
   });
+
+  describe('hasNonceExpired', () => {
+    const HOUR = 1000 * 60 * 60;
+
+    it('No setting set, could not expire', () => {
+      expect(strategy['hasNonceExpired'](query.properties)).equal(false);
+    });
+
+    it('Setting set, nonce expired', () => {
+      strategy['maxNonceTimeDelay'] = HOUR / 1000;
+
+      expect(
+        strategy['hasNonceExpired'](
+          query.change({
+            'openid.response_nonce': `${getISODate(
+              new Date(Date.now() - 2 * HOUR),
+            )}8df86bac92ad1addaf3735a5aabdc6e2a7`,
+          }),
+        ),
+      ).equal(true);
+    });
+
+    it('Setting set, nonce not expired', () => {
+      strategy['maxNonceTimeDelay'] = HOUR / 1000;
+
+      expect(
+        strategy['hasNonceExpired'](
+          query.change({
+            'openid.response_nonce': `${getISODate(
+              new Date(Date.now() + HOUR / 2),
+            )}8df86bac92ad1addaf3735a5aabdc6e2a7`,
+          }),
+        ),
+      ).equal(false);
+    });
+  });
 });