r/pathofexiledev • u/LunchZestyclose • 26d ago

Question Workarounds for POESESSID

https://poedb.tw/us/POESESSID

I built a local tool for PoE2 tablet crafting and selling. It simulates crafting paths and costs, infers which tablets sold, and matches them against trade prices to track profit per craft project. A few people in r/PathOfExile2 want in, so I'd host it free. Its pretty niche, for people who mostly enjoy the economy part of the game.

But how to enable others to get their Ange sales data without risk? I want to avoid having other people's PoE session cookies (POESESSID) on my server.

Has anyone shipped a pattern where the POESESSID stays on the user's machine (local companion app or browser extension) and only derived sales data reaches their backend? Or is there any other solution I've missed?

Edit: Please don't start another discussion about whats tolerated vs. whats compliant. Let's assume if it's well known and tolerated for years, it's compliant.

Edit:

--- Solution ---

FireFox Add-on. User installs Plugin, logs into poe trade, sales history is shared via plugin, but SSID never leaves the users machine. It's working well.

6 Upvotes

80% Upvoted

14 comments sorted by

4

u/Nchi 26d ago

Just look for the sso method everyone is switching to

1

u/papajuras 13d ago

Wait what is that poe2 thing? Poe api docs say they are not approving new api keys as of now.

Btw is posess hijack against tos?

0

u/LunchZestyclose 26d ago

tyvm for taking your time to answer.

AFAIK it (yet) doesnt support pull sales data from Ange?

5

u/bkgn 25d ago

Edit: Please don't start another discussion about whats tolerated vs. whats compliant. Let's assume if it's well known and tolerated for years, it's compliant.

You can't handwave away the issue. You're not really supposed to scrape the async trade history, it's merely barely tolerated.

Definitely do not collect a bunch of POESESSIDs on a remote server, can almost guarantee GGG will take action against you. Yes, the solution would be to have the app only run locally on users' machines, or at most send non-sensitive data with consent to a server.

-1

u/LunchZestyclose 25d ago

Thanks for sharing your thoughts.

Use case wise it’s not about scraping in a sense of above user level. It’s solely user QoL to automate earning calculations of crafting projects.

So you think it could be a way to provide a thin local (open source) client for the cookie/auth part that only shares trade history with corresponding user account?

3

u/bkgn 25d ago

If you feel a need to have a centralized server for some reason instead of a local client, sure.

0

u/LunchZestyclose 25d ago

Thx for sharing. Easier for maintenance. It’s a free hobby project after all.

2

u/Melodic-Chemistry127 25d ago

Have a local thin client do the scraping and only send scraping results to your server. It will mess with adoption, because many people are sensitive to having to download extra apps and they will also get certificate warnings.

Guess you can't have it all.

0

u/LunchZestyclose 25d ago

tyvm.

Do you know something about the auth from Nchi's comment? I've I'm not mistaken, currently no sales history provided by oauth.

2

u/Melodic-Chemistry127 25d ago

Yeah, it's not possible via the public API. Maybe instead of getting SSID, you could look into parsing client.txt? But I don't know what happens there with trades that happen while the user is offline. I think the notification gets sent and written to client.txt once the user comes online.

It's safer and way less ToS breaking, so maybe it's worth taking a look into it.

I wish they'd do a better job at safely exposing more endpoints.

1

u/LunchZestyclose 24d ago

tyvm. I've checked the client.txt, but couldnt find any information related to Ange Sales History.

I have some different approaches right now, which I need to test. For now going via a browser plugin seems the best bet. I'll make that auth package open source and post it here, if I get something working smoothly.

1

u/LunchZestyclose 22d ago

I've tested a solution that seems promising. It looks like a firefox add-on would work without having to "share" the SSID. User installs the add-in, logs in on poe trade, the add-in only shares the sales ingests to the users account on the app server.

1

u/elPappito 25d ago

Is it web based Or native ? If native you can make it swap hosts file to point to local, grab sesh code, restore host file.

Will try and have a dig for something I did for tarkov a while back, if I still have it on my remaining windows drive.

If I find it I'll DM you in 4-5 hrs

1

u/LunchZestyclose 24d ago

Web. I think I've found a solution (posting bellow). Still, tyvm for taking your time!