Hi guys,
we are using vue as frontweb and python as backend for our non-embedded app,here is our example code for auth:
@shopify_router.get("/install")
async def shopify_install(request: Request, shop: str):
"""
shopify installation authentication and trusted authentication are the same url
1. Check the check. If the check fails, return to the shopify app listing page or Custom page
2. Check whether the store is installed or expired
2.1 If no, return to the shopify app listing page
3. After the installation is successful, the session information and jwt are provided to the front-end. Front-end subsequent requests carry jwt parameters
:param request: fast api request object
:param shop: shop info
:return:
"""
request_args = dict(request.query_params)
# pop hmac,hmac is not used to sign check.
hmac = request_args.pop("hmac", "")
if not hmac:
return RedirectResponse(url=f"https://www.google.com") # todo you can replace the page to anything customer page url
# change the key value with sort,otherwise the sha256 value is diff.
data = '&'.join([
'%s=%s' % (key, value)
for key, value in sorted(request_args.items())
])
is_auth = verify_webhook_data(data, hmac)
if not is_auth:
return RedirectResponse(url=f"https://www.google.com") # todo you can replace the page to anything customer page url
# TODO It is depens on you own bussiness flow.
is_installed = check_installed(shop)
if not is_installed:
return RedirectResponse(
url=f"https://{shop}/admin/oauth/authorize?"
f"client_id={Your App Client Id}"
f"&scope={Your App need Scopes}"
f"&state={}"
f"&redirect_uri={Your App Allowed Redirect Uri}"
)
# TODO if success,you can set your own jwt or cookie as response to web
return RedirectResponse()
def verify_webhook_data(data: str, hmac_header):
digest = hmac.new(
{Your App Secret}.encode("utf-8"),
data.encode("utf-8"),
digestmod=hashlib.sha256
)
computed_hmac = digest.hexdigest().encode("utf-8")
return hmac.compare_digest(computed_hmac, hmac_header.encode("utf-8")
P.S.
1. /install means shopify app url,you can set your own on app dashboard -> App Setup -> URLs -> App URL
If you have any questions,please reply to me and I will improve the answer.
