Simplify the auth flow by removing the full page redirect. #1075

Kyon147 · 2022-02-04T15:31:05Z

This PR looks to reduce the complexity around the Auth flow but keep the same functionality.

it looks to hopefully solve the issue here around #1073 that because of the "auth/token" coming first before the oAuth it fails the Shopify public app requirements.

By just redirecting to the pure URL which is built it removes the need to use the full page redirect.

…into feature/simplify-the-auth-flow

stevesweets · 2022-03-01T14:07:53Z

This makes a dramatic positive difference to the auth flow.

Kyon147 · 2022-04-27T09:36:07Z

Hey @osiset - as you are very busy, do you want me to merge this into master and create a new release. This should help a lot of users who are currently getting rejected from Shopify because of the "auth/token" redirect creates in between OAUTH which is against their guidelines.

Let me know and i can get this out today and set up a patch release.

gnikyt · 2022-04-27T12:56:28Z

Sure!

…

On Wed., Apr. 27, 2022, 07:06 Luke Walsh, ***@***.***> wrote: Hey @osiset <https://github.com/osiset> - as you are very busy, do you want me to merge this into master and create a new release. This should help a lot of users who are currently getting rejected from Shopify because of the "auth/token" redirect creates in between OAUTH which is against their guidelines. Let me know and i can get this out today and set up a patch release. — Reply to this email directly, view it on GitHub <#1075 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AASO4OUVVHV4BCXZ7BS5L5TVHEDBFANCNFSM5NSCZ35Q> . You are receiving this because you were mentioned.Message ID: ***@***.***>

stevesweets · 2022-07-28T12:25:43Z

@Kyon147 i think i've discovered an issue here.

If

you've got an embedded app
you need to change the scopes

The redirect fails with the old classic https://yyyyyyy.myshopify.com refused to connect, and in the console

Refused to display 'https://yyyyyyy.myshopify.com/' in a frame because it set 'X-Frame-Options' to 'deny'.

... as we know, and as is referenced here: https://community.shopify.com/c/shopify-apis-and-sdks/changing-scope-x-frame-options/td-p/1193972

Obviously, because if you are in an iframe, one cannot simply:

// Just return them straight to the OAUTH flow.
return Redirect::to($result['url']);

Any ideas?

Kyon147 · 2022-07-28T12:29:24Z

Yeah I noticed the same issue, we need to move back to the full page redirect in this instance much like when you change the api scopes the same issue happens.

There's another auth PR which needs to be merged #1097 as this fixes the other issue bust sorts out the iframe redirect one too by moving it back as before.

I'd move back to v17.1.0 for now.

I'll create a hotfix for the current release to remove my PR but keep the other fixes.

stevesweets · 2022-07-28T12:32:44Z

This works, but is there a particular reason it shouldn't be done this way?

return View::make('shopify-app::auth.fullpage_redirect', [ 'authUrl' => $result['url'] ]);

``

    <title>Redirecting...</title>

    <script type="text/javascript">
        window.top.location.href = '{{ $authUrl }}'
    </script>
</head>
<body>
</body>

``

stevesweets · 2022-08-11T16:29:47Z

@Kyon147 apologies, but this seemed to miss your attention. Do you have any thoughts on if the above would be acceptable?

Kyon147 · 2022-08-11T16:40:46Z

Hey @stevesweets

It's sort of the same result as #1097 but this PR uses the AppBridge functions which is probably a little more inline with Shopify if they ever come back on a App Review.

Your way would work in the same essence as the fullpage_redirect view does effectively the same thing.

stevesweets · 2022-08-11T22:44:29Z

Hey @stevesweets

It's sort of the same result as #1097 but this PR uses the AppBridge functions which is probably a little more inline with Shopify if they ever come back on a App Review.

Your way would work in the same essence as the fullpage_redirect view does effectively the same thing.

Ok nice, thanks for the response :)

talktohenryj · 2022-09-21T16:39:56Z

I've been reading through this. So does this mean if I upgrade to 17.2.0 my app should automatically send merchants to reauthenticate if I change the scopes?

I ask because I am adding a new scope and when I add it my test store does not automatically reauth. I am currently on 17.1, I am wondering if upgrading to 17.2 will fix my issue. It sounds like it will.

Kyon147 · 2022-09-21T16:43:17Z

Hey @talktohenryj - yeah upgrading to 17.2 should fix that issue for you.

talktohenryj · 2022-09-22T13:47:05Z

hmmm, i did the update but still have the issue. Do I need to be on a specific PHP version? I am currently running 7.4 on dev and production.

stevesweets · 2022-09-28T15:38:02Z

hmmm, i did the update but still have the issue. Do I need to be on a specific PHP version? I am currently running 7.4 on dev and production.

it may be relevant, it may not - but, it will only reauth when the current session ends.

Kyon147 added 7 commits February 4, 2022 15:28

Simplify the auth flow by removing the full page redirect.

aaeb07f

Simplify the auth flow by removing the full page redirect.

aacd1c5

Merge remote-tracking branch 'origin/feature/simplify-the-auth-flow' …

84e8df8

…into feature/simplify-the-auth-flow

Fix elseif

793e4ba

Fix CF Fixer Style

b155a6f

Update tests for the no code

d68e0dd

Merge branch 'master' into feature/simplify-the-auth-flow

f2cf02f

nathan-hutchinson mentioned this pull request Mar 1, 2022

URGENT UPDATE need to shopify_app v18.1.1 or @shopify/koa-shopify-auth v5.0.3 #1094

Closed

Kyon147 mentioned this pull request Mar 15, 2022

Fixed app-bridge redirect on fullpage_redirect auth view #1097

Closed

Kyon147 merged commit 8eb0181 into master Apr 27, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Simplify the auth flow by removing the full page redirect. #1075

Simplify the auth flow by removing the full page redirect. #1075

Kyon147 commented Feb 4, 2022

stevesweets commented Mar 1, 2022

Kyon147 commented Apr 27, 2022

gnikyt commented Apr 27, 2022 via email

stevesweets commented Jul 28, 2022 •

edited

Loading

Kyon147 commented Jul 28, 2022 •

edited

Loading

stevesweets commented Jul 28, 2022 •

edited

Loading

stevesweets commented Aug 11, 2022

Kyon147 commented Aug 11, 2022

stevesweets commented Aug 11, 2022 •

edited

Loading

talktohenryj commented Sep 21, 2022

Kyon147 commented Sep 21, 2022

talktohenryj commented Sep 22, 2022

stevesweets commented Sep 28, 2022

Simplify the auth flow by removing the full page redirect. #1075

Simplify the auth flow by removing the full page redirect. #1075

Conversation

Kyon147 commented Feb 4, 2022

stevesweets commented Mar 1, 2022

Kyon147 commented Apr 27, 2022

gnikyt commented Apr 27, 2022 via email

stevesweets commented Jul 28, 2022 • edited Loading

Kyon147 commented Jul 28, 2022 • edited Loading

stevesweets commented Jul 28, 2022 • edited Loading

stevesweets commented Aug 11, 2022

Kyon147 commented Aug 11, 2022

stevesweets commented Aug 11, 2022 • edited Loading

talktohenryj commented Sep 21, 2022

Kyon147 commented Sep 21, 2022

talktohenryj commented Sep 22, 2022

stevesweets commented Sep 28, 2022

stevesweets commented Jul 28, 2022 •

edited

Loading

Kyon147 commented Jul 28, 2022 •

edited

Loading

stevesweets commented Jul 28, 2022 •

edited

Loading

stevesweets commented Aug 11, 2022 •

edited

Loading