Steam/Google sign-in & Local Network Access

When logging into Heartopia on Steam,

via Google sign-in, either the browser login doesn't load, or the browser prompts for a permission request for Local Network Access or to Access other apps and services on this device.

This has caused lots of concern from players around privacy and security, with a common theme being that "other games have never asked for this in the past."

Here is the start of some clarity I hope, and a prompt to those more educated on computer security to correct this post or add to it.

Firstly, there reason your browser does not load at all past the Google login page, is due to you having certain ad-blocking, anti-malware, and so on extensions, software or whatever it may be enabled. An example would be an extension in Chrome, or perhaps if you are using Brave. Turning this off, and retrying you should now get a prompt from the browser itself to allow either 'Local Network Access', 'Allow access to other apps and services on this device', or something to that effect.

The valid concern now comes from granting this access. This permissiom request is new since Chrome 138 as optional enabled, and from Chrome 139 default enabled. Firefox are rolling it out experimentally. Edge, well who cares about them. As for other browsers, you can search it up. The point is that this permission prompt appears to be fairly new.

So to the point of "other games have never asked for this in the past." This is due to the recent past not having this permission prompt on the browsers as described above. Previulsly websites were by default grated permission. Completely log out of a similar game that has never asked this, and then log back in. You should see this request, as long as you completey log out and remove history data.

What does this permission actually grant the website then? Generally and technically speaking, it seems that any request made by a browser to any address reserved for local use. These addresses include the likes of 192.168.x.x addresses, the loopback, and others to a similar nature. These are defined with regards to Chromium browsers through the link below. In the case of Heartopia, when you click the login button, Google sign-in opens on your browser, you login, and then there is a request made to a randomised port on 127.0.0.1 (loopback, i.e. your device).

Ok so why is this happening and what data is being sent? What is likely happening, is that when you open Heartopia in Steam, the game loads and opens a network connection, much like any app or software does, to Heartopia's server. The game loads up, and you then click on "Login with Google" on Heartopia in Steam. Heartopia tells your computer to open up Google's official sign in. This prompts the browser to open a webpage, another connection if you like. This one connects to Google, obviously, where you can then login. Google is aware that this login has been prompted by Heartopia. Once you login here, Google then needs to tell Heartopia that the login was successful, along with who the player is of course. Heartopia does not know this yet.

This part is the crux of the issue. In order for Google to tell Heartopia the login is successful, Google needs to speak to Heartopia. This information needs to be shared locally via a port, a web server essentially. This is the permission request you are seeing. Browsers no longer allow this connection to happen by default. Allowing it means that Google can send some identity information to Heartopia via the browser. Heartopia then can use this information to log you in and confirm identity.

I have yet to log into Heartopia in this manner whilst carrying out a complete log of network traffic, in order to fully see what is sent where. I have looked at the headers, connections, and so on at surface level, which seems to work hand-in-hand with the documentation I have read to confirm this. However I have not yet found this explicitly from any developer involved in the chain of Heartopia, Steam, Google, and so on.

Happy to be better informed, as I am not an expert in this, and all I have written down are my musings from what I have gathered so far. I could be very wrong.

For more information, do look up the likes of OAuth and OpenID and general APIs.

https://developer.chrome.com/blog/local-network-access

https://support.mozilla.org/en-US/kb/control-personal-device-local-network-permissions-firefox