Sessions
Passwords and kicking players
Restricting who can stay in a session, and the honest limits of it.
Read this first
Steam lobbies have no server side authority. There is no host process validating anything, only peers agreeing to behave.
That means password checks and kicks in SteamForge are cooperative. They are enforced by the joining or kicked player's own copy of the game. A modified client can ignore them.
They are good for keeping a friends game tidy and stopping strangers wandering in. They are not a security boundary. Anything that must actually be enforced belongs on a dedicated server you control.
This is a property of Steam lobbies, not a limitation of the plugin, and no plugin can work around it.
Passwords
Set Password on your session settings when hosting. Joiners pass the same value to Join Session. A mismatch comes back as Wrong Password, and SteamForge leaves the lobby again on their behalf.
The password is published as lobby metadata, so it is readable by anyone who can read the lobby. Do not reuse anything that matters.
Search results expose Password Protected so your browser can show a lock icon and prompt before attempting the join.
Kicking
On the SteamForge Sessions subsystem, host only:
| Node | What it does |
|---|---|
| Kick Player | Removes a player, optionally banning them |
| Unban Player | Lifts a ban |
| Get Banned Players | Everyone banned from this session |
| Is Player Banned | Check one player |
Kick Player has a Ban input. Without it the player can rejoin immediately. With it they are refused for as long as the session lives.
How a kick reaches the player
The host publishes the kick to lobby data. The target's own client sees its Steam ID on the list and leaves.
On the kicked player's side, bind On Removed From Session, which reports whether it was a kick or a ban. Use it to return them to the menu with an explanation rather than leaving them in a session they are no longer part of.
The host can also bind On Player Removed for a match log.