With the strong focus on privacy, browsers have recently started phasing out support for the 3rd party cookie. This has caused issues for embedded apps which until now have required the use of 3rd party cookies. Our new App Bridge auth beta introduces “session tokens” to empower developers to creat…

I’m coming late to this thread, but only because my app was just rejected due to, ostensibly, a cookies issue ( https://community.shopify.com/c/Shopify-APIs-SDKs/App-Rejected-shopify-app-gem-In-Shopify-POS-we-were-met-with/m-p/874578#M55941 ). I have another app live in the app store where I did the …

The problem is how are your REST API calls authenticated?

Hi @BGilbert thanks for the quick response - not sure if this is answering your question specifically, but I do this: Request comes in through my app - validate hostname and hmac validity. If it passes, they can proceed to the actual app At that point, during the app session the user can perform c…

Unfortunately with what explained, anyone can just call the REST API calls easily to manipulate other shops by just knowing the other shops .myshopify.com URL Unrelated to the above, I’m trying to use the ES5 AppBridge but my call to getSessionToken throws an error: Uncaught (in…

@BGilbert you’re right, I just re-read what I wrote and realized I should put a second hmac validation check for each and every server side request (and probably validate the timestamp is current as well). I think should handle it though?

@BGilbert I’ll message you privately so as not to clutter up this thread!

Hi! This looks like a mistake in our documentation. The getSessionToken utility takes the app as its argument. We’ll update the docs, thanks for reporting!

@dsingh replying to your “Considering that now there is no need for use of cookies. Is there a way to retrieve the myshopify.com domain an embedded app is loaded in? That is probably the last part which is needed before embedded apps can be truly cookie-less.” question: The domain is passed as a qu…

Introducing cookieless authentication beta with App Bridge

Retired Boards Appdev Tools

BGilbert September 10, 2020, 4:40pm 66

Unfortunately since the subsequent request come from your own website, they won’t have any of the HMAC stuff.

Topic		Replies	Views
Video tutorial on using JWT session tokens to authenticate your embedded app Authentication	14	398	February 27, 2024
Authenticated fetch for new cookie policy error Graphql Basics And Troubleshooting	24	321	June 9, 2021
Shopify App Bridge Requirement Tools	3	143	February 22, 2022
session tokens and not rely on 3rd party cookies to function properly. Shopify Apps third-party-apps , shopify-apps	1	61	October 16, 2024
Shopify App Gets Caught in Infinite 'Enable Cookies' loop in Safari Authentication	79	1033	February 9, 2023

Introducing cookieless authentication beta with App Bridge

Related topics