Cookie not returned in install callback request object

New Member
1 0 0

Hi, 

I just got started building a Shopify app, so I'm following the tutorial here: https://help.shopify.com/en/api/tutorials/building-node-app. I'm using Node for my endpoint. I've successfully done everything and can make api calls with a permanent access token...

The problem I'm having is that the request object attached to the `/shopify/callback` route that is redirected to when the person installs my app does not contain the cookie I sent with the response when I redirected to the shopify app install page. So I can't verify the origin of the request was from me.

I'll paste in the relevant code I am referring to:

app.get('/shopify', (req, res) => {
  // other code emitted for sake of brevity
  const state = nonce();
  const redirectUri = forwardingAddress + '/shopify/callback';
  const installUrl = 'https://' + shop +
      '/admin/oauth/authorize?client_id=' + apiKey +
      '&scope=' + scopes +
      '&state=' + state +
      '&redirect_uri=' + redirectUri;
  res.cookie('state', state); // <---- HERE IS WHERE I'M SETTING THE COOKIE TO CHECK THE ORIGIN
  res.redirect(installUrl);
}

app.get('/shopify/callback', (req, res) => {
  const { shop, hmac, code, state } = req.query;

  // HERE IS WHERE I GET THE COOKIE TO CHECK THE ORIGIN
  const stateCookie = cookie.parse(req.headers.cookie).state;

  if (state !== stateCookie) { <----- ALWAYS TRUE, SO REQUEST ORIGIN IS NOT VERIFIED
    return res.status(403).send('Request origin cannot be verified');
  }
}

I've checked the req/res objects for this cookie in the /shopify/callback route, but there's never a cookie...

I have noticed that sometimes when redirected to the shopify install page, a red alert appears and says something like "this page doesn't accept third party cookies", so I'm wondering if that has something to do with it...?

Any ideas why the cookie doesn't come back with the callback request object?

0 Likes
Highlighted
New Member
1 0 0

Did you get an answer for this???

0 Likes