[BUG] 403 Forbidden in poll_login()

[foresto]

Describe the bug

Login.do_login() recently started crashing with a 403 Forbidden error when poll_login() makes a request to https://login.steampowered.com/jwt/finalizelogin

To Reproduce

1. Call Login.do_login()
2. See error

Expected behavior
The login process should complete normally, as it did when I used it a few months ago.

Desktop (please complete the following information):

• OS version: Debian Bookworm
• Program version: stlib v2.3.1

Additional context

File "/usr/lib/python3.11/asyncio/base_events.py", line 653, in run_until_complete
  return future.result()
        ^^^^^^^^^^^^^^^
File "[...]/stlib/login.py", line 352, in do_login
  login_data = await self.poll_login(steamid, client_id, request_id)
              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "[...]/stlib/login.py", line 256, in poll_login
  json_data = await self.request_json(f'{self.login_url}/jwt/finalizelogin', data=data)
              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "[...]/stlib/utils.py", line 251, in request_json
  response = await self.request(*args, **kwargs)
            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "[...]/stlib/utils.py", line 379, in request
  raise exception from None
File "[...]/stlib/utils.py", line 348, in request
  async with self.http_session.request(**request_params) as response:
File "/usr/lib/python3/dist-packages/aiohttp/client.py", line 1141, in __aenter__
  self._resp = await self._coro
              ^^^^^^^^^^^^^^^^
File "/usr/lib/python3/dist-packages/aiohttp/client.py", line 643, in _request
  resp.raise_for_status()
File "/usr/lib/python3/dist-packages/aiohttp/client_reqrep.py", line 1005, in raise_for_status
  raise ClientResponseError(
aiohttp.client_exceptions.ClientResponseError: 403, message='Forbidden', url=URL('https://login.steampowered.com/jwt/finalizelogin')

[foresto]

My application was working when stlib v2.3.1 was released and hasn't changed since then. Maybe Steam recently changed something?

[foresto]

Possibly related:

bukson/steampy#431

bukson/steampy#432

If that is the same problem, it looks like the change happened in February.

[foresto]

Following the ideas in bukson/steampy#432 and commits from several of that package's forks, I tried adding these headers to the /jwt/finalizelogin request:

    'Origin': 'https://steamcommunity.com',
    'Referer': 'https://steamcommunity.com/',

This seems to fix the 403 error. However, I have not tested it extensively, and I have not validated it against the official client's behavior.

In particular, I wonder:

• Should the Referer URL should be more specific?
• Should these headers be sent only in certain contexts / login flows?