All things Shopify and commerce
Join us March 21 for an AMA on planning your 2023 marketing budget with 2H Media co-owners, Matt and Aron
I would like to verify the user who wants to access the admin panel of my Shopify app after the app is already installed in the shop. Shopify delivers a session token as a parameter, if the user wants to access the admin panel. As far as my understanding goes, the session token is exactly for that, to verify the shop and if the user is authenticated at the Shopify site.
What do I do with it? In the manual it is referenced as a JWT token but it does not have the structure header.payload.signature. So I don't really know what to do with it. I don't want to use any foreign library.
I would like to refresh this thread to increase the chance that somebody will see it.
I have the same issue.
I can see some documentation around it. https://shopify.dev/tutorials/authenticate-your-app-using-session-tokens#verify-the-signature
But it is difficult to comprehend it.
Can someone help?
How does your application architecture look like? Do you work with a backend?
a bit more context about your embedded app would be useful.
I use t the getSessionToken function from the app-bridge-utils to obtain session tokens. To validate the token I send it to the backend.
You could decode the jwt token on the client-side using libraries like jwt-decode. If you don't want to use a 3rd party library as you mentioned, you could check the code to learn how jwt tokens are encoded.
To make sure the jwt token was issued by Shopify the signature needs to be verified. This is really important for security reasons. Since your app's secret key was used to sign the token you should validate it in your backend. Otherwise, you would have to expose the secret to the client to perform the validation. That would cause more security issues.
Another idea would be to use the token and call an endpoint of the Shopify Admin API directly (if you don't have a backend). E.g. get the shop configuration. If the call returns a successful response you can be sure that the user has access to your shop.
Just some thoughts. Hope it helps.
Thanks to all Community members that participated in our inaugural 2 week AMA on the new E...By Jacqui Mar 10, 2023
Upskill and stand out with the new Shopify Foundations Certification programBy SarahF_Shopify Mar 6, 2023
One of the key components to running a successful online business is having clear and co...By Ollie Mar 6, 2023