[Shopify App] To pass the content security policy attached to the header in the redirect to front ?

Shopify Apps
1

I’m a golang develper in Japan.

I am currently developing shopify app by golang(backend) and react(front).

I am in the process of implementing a content security policy.

https://shopify.dev/apps/store/security/iframe-protection

My app’s authentication process is doing on only backend.

After authentication, redirect to front.

I’m having trouble because to pass header to frontend when redirecting to the front.

Would I need to re-create the authentication as through front to solve the content security policy issue?

sorry for my poor English.:slight_smile:

2

Hi! My case is exactly the same as yours. Did you figure out how to get it approved by Shopify?

In my case I am doing the following (NodeJS):

if (request.query.shop) {
  response.setHeader(
    "Content-Security-Policy",
    `frame-ancestors https://${request.query.shop} https://admin.shopify.com;`,
  );
}

next();