How to make secure HTTP requests from a Shopify App page

Shopify Apps
1

I’m developing a new app (which is also my first) for the Shopify store. In the main page of my app (e.g. https://admin.shopify.com/store/[a-test-store]/apps/[my-app]) I’ve created a page according to the documented examples.

This page (opened in an IFrame within the Shopify admin) uses the HMAC so I can verify that it’s being opened by Shopify, and to get the current store. Using this information I can get information relevant to that store (using a previously stored token).

My question is, what’s the recommended way to make additional API calls from within that page to my server. For example, navigate to another page, or make an API call to my server. I want to make sure that the calls made by my app aren’t spoofed.

Is there an existing best practice? Should I create my own signing method (similar to the HMAC)? Create a token system (generated once I authenticated the first page using it’s HMAC)?

Am I missing something altogether and this isn’t necessary?

Thanks.

2

I know this is a really old post, but you can use HMAC to verify all your requests from Shopify! Take the same code you used to verify the HMAC for the home page, and use it for every request coming from Shopify. There will be an hmac param in window.location.search that you can use!