Logged_in_customer_id is missing on proxied requests from the Thank You/Order Status page

Technical Q&A
1

I am using an app proxy to provide information on the Thank You page regarding an order. The logged_in_customer_id parameter is empty in some cases coming from the Thank You / Order Status page.

The code has access to {{customer.id}} but I cannot validate the request is actually from that customer without logged_in_customer_id. I need to validate the customer is the one making the call so that i do not return information about a different customer.

I can always reproduce this missing parameter if I log out of Shopify and then open (or open in Incognito) the Order Status URL
(e.g. https://{SHOP}.myshopify.com/{number}/orders/{blah}/authenticate?key={key}). The order status page shows the Shipping Address and Payment method( so the customer has been validated) but calls to my proxied app show a blank logged_in_customer_id (e.g. /apps/blah?shop={shop}.myshopify.com&logged_in_customer_id=&path_prefix=%2Fapps%2blah&timestamp=1695391047&signature={signature})

If I open an order link without the key (e.g. https://{shop}.myshopify.com/{number}/orders/{blah}) in an incognito window, the user is prompted to “Login” with their e-mail and order number. After “Login”, the logged_in_customer_id is still NOT sent with requests to the proxy.

The logged_in_customer_id is part of what is used to validate the proxied request but it is missing in these cases.

How can I provide order-specific information (or update order information) when I am prevented from validating that the order belongs to this customer?

2

According to the Configuration page for Checkout Extensions, the logged_in_customer_id parameter is not provided, and one needs to use a session token to validate which customer the call came from.

App Proxy> > UI extensions can make fetch requests to App Proxy URLs, but there are some differences and limitations related to the security context within which UI extensions run.> > UI extension requests made to the App Proxy will execute as CORS requests. See Required CORS headers above for information about requirements related to CORS.> > UI extension requests made to the App Proxy will not assign the logged_in_customer_id query parameter. Instead use a session token which provides the sub claim for the logged in customer.

https://shopify.dev/docs/api/checkout-ui-extensions/2023-10/configuration