URGENT: oauth_error=same_site_cookies (Cookies issue on re-install app)

Technical Q&A
,
1

Hey,

We are suddenly started facing this issue where specifically on re-installing app it gives an error
Though app seems to be installed but not authenticated or cookies getting blocked we are not sure either

There are lot of unanswered threads I have already went through and this issue specifically came to our Remix app

Our browsers are right and even Shopify team sent video where their cookies were enabled
This issue comes randomly not always so you need to re-install 2-3 times to see it. The app will work fine if you just open app and refresh.

image
image849×159 10.9 KB

import "@shopify/shopify-app-remix/adapters/node";
import {
  AppDistribution,
  DeliveryMethod,
  shopifyApp,
  ApiVersion,
} from "@shopify/shopify-app-remix/server";
import { restResources } from "@shopify/shopify-api/rest/admin/2023-10";
import { customSessionStorage } from "../server/session";
import axios from "axios"
require('dotenv').config();
import crypto from 'crypto';
import { redirect } from "@remix-run/node";

const shopify = shopifyApp({

  apiKey: process.env.SHOPIFY_API_KEY,
  apiSecretKey: process.env.SHOPIFY_API_SECRET || "",
  apiVersion: ApiVersion.October23,
  scopes: process.env.SHOPIFY_API_SCOPES?.split(","),
  appUrl: process.env.SHOPIFY_APP_URL || "",
  authPathPrefix: "/auth",
  useOnlineTokens: true,
  sessionStorage: new customSessionStorage(),
  distribution: AppDistribution.AppStore,
  restResources,

  webhooks: {
    APP_UNINSTALLED: {
      deliveryMethod: DeliveryMethod.Http,
      // arn: process.env.EVENTBRIDGE_ARN,
      callbackUrl: "/webhooks",
    },
    CUSTOMERS_DATA_REQUEST: {
      deliveryMethod: DeliveryMethod.Http,
      callbackUrl: "/webhooks",
    },
    CUSTOMERS_REDACT: {
      deliveryMethod: DeliveryMethod.Http,
      callbackUrl: "/webhooks",
    },
    SHOP_REDACT: {
      deliveryMethod: DeliveryMethod.Http,
      callbackUrl: "/webhooks",
    },
    // THEMES_PUBLISH: {
    //   deliveryMethod: DeliveryMethod.Http,
    //   callbackUrl: "/webhooks",
    // },
    // ORDERS_CREATE: {
    //   deliveryMethod: DeliveryMethod.Http,
    //   // arn: process.env.EVENTBRIDGE_ARN,
    //   callbackUrl: "/webhooks",
    // }
  },

  hooks: {
    afterAuth: async ({ session }) => {
      shopify.registerWebhooks({ session });
      console.log('after auth getting called');
      const shop = session.shop;
      const scopes = session.scope;
      const redirectUri = `${process.env.SHOPIFY_APP_URL}/app`;
      const nonce = crypto.randomBytes(16).toString('hex');
      const accessMode = 'offline';

      const myInstance = new customSessionStorage();
      // Call the function from the class using the instance
      const response = await myInstance.loadSession(`offline_${shop}`)

      axios.post(`${process.env.SHOPIFY_BASE_URL}/api/user/auth-user?shopName=${shop}`, {
        shopName: shop,
        accessToken: response.accessToken,
        otherInfo: session.onlineAccessInfo,
        planId: '',
        timezone: '',
        isSubscription: false,
        status: 1,
      }).then(function (response) {
        console.log('user authenticated');
      }).catch(function (error) {
        console.log(error);
      });
    },
  },
  // isEmbeddedApp: true,
  future: {
    // unstable_newEmbeddedAuthStrategy: true,
  },

  ...(process.env.SHOP_CUSTOM_DOMAIN
    ? { customShopDomains: [process.env.SHOP_CUSTOM_DOMAIN] }
    : {}),
});

export default shopify;
export const apiVersion = ApiVersion.October23;
export const addDocumentResponseHeaders = shopify.addDocumentResponseHeaders;
export const authenticate = shopify.authenticate;
export const unauthenticated = shopify.unauthenticated;
export const login = shopify.login;
export const registerWebhooks = shopify.registerWebhooks;
export const sessionStorage = shopify.sessionStorage;



// auth.$.js
import { authenticate } from "../shopify.server";

export const loader = async ({ request }) => {
  console.log("AUTH ON INSTALL?")
  const { session } = await authenticate.admin(request);
  return null;
};

We have been warned that our app will be removed from shopify store because of this sudden issue that came recently

Can anyone guide me what i need to do to fix it, I’m already burned out experimenting and searching through web for past 2 days!

2

Hi there,

We’ve also run into this issue recently on Remix apps. From our investigation, it’s often related to session handling and cookie policies, not the Shopify API itself. Some recommendations that helped us stabilize authentication:

  • Ensure your auth.$.js loader actually redirects to /app after authentication, otherwise Shopify may treat the install as incomplete.

  • If your app is embedded, make sure isEmbeddedApp: true is set in your shopifyApp config.

  • Check that your session storage correctly sets cookies with SameSite=None; Secure, since Safari/Chrome block third-party cookies by default.

  • In the afterAuth hook, avoid blocking external API calls. Handle them asynchronously so authentication can complete cleanly.

This reduced the random failures we saw on re-installs. It may also be worth enabling detailed session logs in your custom storage to confirm installs are persisting properly.

Best,
Sinh Developer, from Tipo

3

Hey Tejas,

Thanks for sharing this. Yes, the `same_site_cookies` issue usually arises due to modern browser restrictions on third-party cookies, especially in embedded apps like Shopify’s.

*Here are a few things you can try:*

  1. *Enable cookies*: Make sure third-party cookies are allowed in your browser.
  2. *Use incognito mode*: Sometimes browser extensions interfere. Incognito helps isolate that.
  3. *Switch browsers*: Try Chrome or Firefox if not already using them.
  4. *Reinstall workaround*: Like you mentioned, reinstalling 2–3 times and refreshing has helped others too.
  5. *Add `sameSite: ‘none’, secure: true`* in session config (if using Express) to help with cross-site cookie behavior.

This is a known issue in the community, and Shopify’s working on improving this across app re-installs. Let me know if you want help with adjusting your app’s session strategy to make it more stable.