HMAC header not being received for mandatory webhooks

jacquibooth
Shopify Partner
4 0 0

I'm trying to implement the HMAC validation for calls to my mandatory webhooks.  However I'm finding that I'm just not getting the HMAC header in the request.  Has anyone else had this problem?

Replies 6 (6)

Pcastro
Shopify Staff
15 0 4

Hello,

 

do you mean that you cannot find X-Shopify-Hmac-SHA256 in the response (not the request) headers?

If that's the case, I could investigate your case further. Could you please DM the date of your test, the topic, and store involved?

 

Thanks

To learn more visit the Shopify Help Center or the Community Blog.

jacquibooth
Shopify Partner
4 0 0
Hi Paco,

It is the POST request made from Shopify to my app for any of the mandatory webhooks. I just (6th Sept 13:08 UTC) logged into my test store (https://linkituk.myshopify.com/) and submitted a customer data request. This failed as the request made from Shopify did not have the HTTP header X-Shopify-Hmac-SHA25 so I wasn’t able to validate the request.

All the best,
Jacqui
Pcastro
Shopify Staff
15 0 4

Hello again and thanks for your patience, 

 

I've been trying to reproduce your issue.

The HMAC header leaves our servers in my tests, but I've observed that our software does some transformation to these that might be not reverted on your side.

(Due to the special nature of mandatory webhooks, they use a different path and this only applies to them)

 

If X-Shopify-Hmac-SHA256 is not present, would you mind trying if you receive HTTP_X_SHOPIFY_HMAC_SHA256 (all capitals and underscored) ? 

 

Thanks!

To learn more visit the Shopify Help Center or the Community Blog.

jacquibooth
Shopify Partner
4 0 0
Hi,

I can’t explain it but It looks like the X-Shopify-Hmac-SHA256 header is now there. Maybe in trying the other name and then putting back the original I corrected a typo but I did check the name repeatedly.

Anyway, thanks for you help.
Girish_Rajwani
Shopify Partner
82 3 8

Hello ,

 

I am getting `X-Shopify-Hmac-SHA256` header blank before creating charge after auth/callback.  I am using node js

 

Can you please share the proper sample code or Any link?  

 

I am stuck on this since hours 🙂

 

Thanks 

*If my answer was helpful, then please click like and accept solution
*Looking for a solution to a problem in your store? Email me at: appsbygirish@gmail.com
*My Shopify Apps: https://apps.shopify.com/partners/girish-rajwani
jacquibooth
Shopify Partner
4 0 0

Hi,

 

I'm sorry but I really have no idea why it suddenly started working.  All I would say is to just double check that you've typed the header name correctly.  The line in my C# code which gets the header is:

 

var headerValues = Request.Headers.GetValues("X-Shopify-Hmac-Sha256");

 

Jacqui