Hi! I’m planning to sell software through Shopify. The software comes with a license file, and the license file is created programmatically upon purchase and uploaded in the Shopify files section. The link to download the license is provided in the customer account page.
The link looks something like:
https://mystore.com/cdn/shop/files/License-CUSTOMER_ID.xml
I noticed that by simply changing the file name, anyone can access all the files I uploaded in my Shopify if the file name is known. One could attempt different CUSTOMER_IDs to try to download licenses that are not the one he/she bought. It can be done even without knowing the password of my currently protected store.
Is there a way to prevent this? Or is my backend design completely wrong?
Thanks!