Automated Hmac Webhook Validation Failing

Shopify Apps
1

I’m building a very simple Oauth app to be put on the shopify marketplace. I am stuck on the automated tests that veify the hmac validation for webhooks.

Screen Shot 2024-04-23 at 12.08.10 PM.png
Screen Shot 2024-04-23 at 12.08.10 PM.png935×222 18.8 KB

I have used the Shopify CLI to test all 3 of my configured webhooks - and have confirmed that they are correctly sending a non-200 response when the hmac is invalid - and a 200 response when it is valid. However I am still failing the second automated test in that screenshot.

I read in another thread (https://community.shopify.com/topic/2488112) that this automated test apparently includes testing for the install page? I do have hmac validation on the install page, I just display an “invalid integration” message to the user in my interface - but I don’t send anything back to shopify on that install page - just display that message to the user. Is there actually an automated test for the install page and if so does anyone know WHAT that test is so I can pass it?

1 Like
2

Same issue here, we need help from shopify people, documentation is really unclear and we have no logs to know what’s wrong.
I also configured the mandatory webhooks with hmac verification but it’s not working.
Did anyone find a solution please ?

3

I still have not found a solution. I did get a chat going with some technical folks at Shopify and they tried to give me some guidance. All they told me was that one of my webhooks was returning a 200 response when it was supposed to be returning a 401. I investigated that endpoint at length and in all my tests confirmed I was returning 401s rather than 200s when it was an incorrect hmac. So it apparently isn’t that issue, or whatever tests I’m doing are not the same as the ones they are doing. I have tried to follow up with shopify to get the specific tests they are running, but have received no response.