With the strong focus on privacy, browsers have recently started phasing out support for the 3rd party cookie. This has caused issues for embedded apps which until now have required the use of 3rd party cookies. Our new App Bridge auth beta introduces “session tokens” to empower developers to creat…

@Liam @Michael_Ragalie I’ll admit I haven’t yet attempted to implement this, but in plain English can you please help me understand the difference between the new JWT vs. authorizing requests using hmac validation (as appended by Shopify in every URL request to one’s app)? In looking through the d…

How can I construct a session and activate it after decoding the JWT token? From the doc , it said: Add middleware that detects requests with a session token present and builds a session based on the shop and user information included in the token. In the previous OAuth way with Python / Django,…

A problem with using the HMAC is that the mechanics for getting a new one are pretty ugly. Every X minutes and every time a page navigation occurs, the app would need to redirect to Shopify and then Shopify would need to redirect back to the app with a new HMAC + timestamp. Another issue is that t…

When we say “session” we mean data associated with a certain shop/user. The idea is that we give you the shop/user via the session token, so you can use that to look up other data about that shop/user in your system, and build whatever session object you need. In this case, presumably you persist t…

@Michael_Ragalie thanks for the response, makes sense. In my case, both of my apps are POS embedded apps and so the “session” is always quite short and moment in time for the merchant. Please keep us updated when JWT becomes available for POS embedded apps.

@Michael_Ragalie I actually haven’t tried it yet, I thought I saw on page 1 or 2 of this thread that someone else asked about it for POS and was told it wasn’t ready. But based on reading the documentation, I also don’t see a reason it shouldn’t work. Thanks for following up.

I’m finding the documentation lacking, i’ve tried trawling through the app-bridge code but that wasn’t much help either. Ideally it would be great if i could embed my app admin functionality but its not a shopify specific application so i don’t really want to pollute it with shopify specific libs a…

I think you’ll need to use App Bridge to get a token. The “manual” approach is still using App Bridge, just lower level aspects of it.

Are apps that don’t use this method getting rejected? We’ve had an application rejected because (we believe) the tester was using incognito mode.

Introducing cookieless authentication beta with App Bridge

Retired Boards Appdev Tools

Michael_Ragalie September 23, 2020, 9:03pm 82

I don’t know if we have any apps using it on POS, but I think it should work. Was there a problem you were running into with it?

Topic		Replies	Views
Video tutorial on using JWT session tokens to authenticate your embedded app Authentication	14	382	February 27, 2024
Authenticated fetch for new cookie policy error Graphql Basics And Troubleshooting	24	270	June 9, 2021
Shopify App Bridge Requirement Tools	3	139	February 22, 2022
session tokens and not rely on 3rd party cookies to function properly. Shopify Apps third-party-apps , shopify-apps	1	56	October 16, 2024
Shopify App Gets Caught in Infinite 'Enable Cookies' loop in Safari Authentication	79	771	February 9, 2023

Introducing cookieless authentication beta with App Bridge

Related topics