Your primary app listing has 2 issues to fix before you can submit your app for review
-
App must set security headers to protect against clickjacking.
To prevent clickjacking attacks, your app must set the proper content security policy directive. If your app is not embedded in an Iframe in the Shopify admin, and you are seeing this message, check your app’s settings and make sure it is set to “non-embedded.” If your app is embedded, then we expect the ‘Content-Security-Policy’ header to be frame-ancestors https://admin.shopify.com https://[shop].myshopify.com, where [shop] is dynamically set to the shop domain the app is embedded on. -
App must verify the authenticity of the request from Shopify.
Expected HTTP 401 (Unauthorized), but got HTTP 200 from https://spiritual-perspective-lawyer-carrier.trycloudflare.com/api/get-web-hook/. Your app’s HTTPS webhook endpoints must validate the HMAC digest of each request, and return an HTTP 401 (Unauthorized) response code when rejecting a request that has an invalid digest. Learn more about securing mandatory GDPR webhooks
my app was developed using Shopify PHP App Template, in which file do I need to add frame-ancestors?
I have Run an app using Cloudflared tunnel, now what is the issue here that I need to fix,
please help me with this, how can I fix this issues.
Thanks.
