diff --git a/.changeset/popular-jokes-roll.md b/.changeset/popular-jokes-roll.md new file mode 100644 index 0000000000..a38e1b8c1d --- /dev/null +++ b/.changeset/popular-jokes-roll.md @@ -0,0 +1,5 @@ +--- +'@shopify/shopify-app-remix': patch +--- + +Now `authenticate.webhook(request);` will return 401 Unauthorized when webhook HMAC validation fails. diff --git a/.changeset/rare-mirrors-cry.md b/.changeset/rare-mirrors-cry.md new file mode 100644 index 0000000000..0c76b15158 --- /dev/null +++ b/.changeset/rare-mirrors-cry.md @@ -0,0 +1,17 @@ +--- +'@shopify/shopify-app-session-storage-postgresql': patch +'@shopify/shopify-app-session-storage-test-utils': patch +'@shopify/shopify-app-session-storage-dynamodb': patch +'@shopify/shopify-app-session-storage-mongodb': patch +'@shopify/shopify-app-session-storage-memory': patch +'@shopify/shopify-app-session-storage-prisma': patch +'@shopify/shopify-app-session-storage-sqlite': patch +'@shopify/shopify-app-session-storage-mysql': patch +'@shopify/shopify-app-session-storage-redis': patch +'@shopify/shopify-app-session-storage-kv': patch +'@shopify/shopify-app-session-storage': patch +'@shopify/shopify-app-express': patch +'@shopify/shopify-app-remix': patch +--- + +Bump shopify-api to ^8.1.1 diff --git a/packages/shopify-app-express/package.json b/packages/shopify-app-express/package.json index 1bf8551954..ce48eb0fbf 100644 --- a/packages/shopify-app-express/package.json +++ b/packages/shopify-app-express/package.json @@ -30,7 +30,7 @@ "Storefront API" ], "dependencies": { - "@shopify/shopify-api": "^8.0.2", + "@shopify/shopify-api": "^8.1.1", "@shopify/shopify-app-session-storage": "^2.0.1", "@shopify/shopify-app-session-storage-memory": "^2.0.1", "cookie-parser": "^1.4.6", diff --git a/packages/shopify-app-remix/package.json b/packages/shopify-app-remix/package.json index 086cebf188..39625a751d 100644 --- a/packages/shopify-app-remix/package.json +++ b/packages/shopify-app-remix/package.json @@ -68,7 +68,7 @@ }, "dependencies": { "@remix-run/server-runtime": "^2.0.0", - "@shopify/shopify-api": "^8.0.2", + "@shopify/shopify-api": "^8.1.1", "@shopify/shopify-app-session-storage": "^2.0.1", "isbot": "^3.6.5", "semver": "^7.5.0", diff --git a/packages/shopify-app-remix/src/server/authenticate/webhooks/__tests__/authenticate.test.ts b/packages/shopify-app-remix/src/server/authenticate/webhooks/__tests__/authenticate.test.ts index ee044223c3..01c5b389bb 100644 --- a/packages/shopify-app-remix/src/server/authenticate/webhooks/__tests__/authenticate.test.ts +++ b/packages/shopify-app-remix/src/server/authenticate/webhooks/__tests__/authenticate.test.ts @@ -130,7 +130,7 @@ describe('Webhook validation', () => { expect(admin?.graphql.session).toBe(session); }); - it('throws a 400 on invalid HMAC', async () => { + it('throws a 401 on invalid HMAC', async () => { // GIVEN const shopify = shopifyApp(testConfig()); @@ -147,7 +147,7 @@ describe('Webhook validation', () => { ); // THEN - expect(response.status).toBe(400); + expect(response.status).toBe(401); }); it.each([ diff --git a/packages/shopify-app-remix/src/server/authenticate/webhooks/authenticate.ts b/packages/shopify-app-remix/src/server/authenticate/webhooks/authenticate.ts index 13fc7273db..197c91830e 100644 --- a/packages/shopify-app-remix/src/server/authenticate/webhooks/authenticate.ts +++ b/packages/shopify-app-remix/src/server/authenticate/webhooks/authenticate.ts @@ -1,4 +1,8 @@ -import {ApiVersion, ShopifyRestResources} from '@shopify/shopify-api'; +import { + ApiVersion, + ShopifyRestResources, + WebhookValidationErrorReason, +} from '@shopify/shopify-api'; import type {BasicParams, MandatoryTopics} from '../../types'; import {AdminApiContext, adminClientFactory} from '../../clients'; @@ -42,8 +46,16 @@ export function authenticateWebhookFactory< }); if (!check.valid) { - logger.debug('Webhook validation failed', check); - throw new Response(undefined, {status: 400, statusText: 'Bad Request'}); + if (check.reason === WebhookValidationErrorReason.InvalidHmac) { + logger.debug('Webhook HMAC validation failed', check); + throw new Response(undefined, { + status: 401, + statusText: 'Unauthorized', + }); + } else { + logger.debug('Webhook validation failed', check); + throw new Response(undefined, {status: 400, statusText: 'Bad Request'}); + } } const sessionId = api.session.getOfflineId(check.domain); diff --git a/packages/shopify-app-remix/src/server/config-types.ts b/packages/shopify-app-remix/src/server/config-types.ts index 81af9cbf1d..78e9b6a3b7 100644 --- a/packages/shopify-app-remix/src/server/config-types.ts +++ b/packages/shopify-app-remix/src/server/config-types.ts @@ -23,6 +23,7 @@ export interface AppConfigArg< | 'isEmbeddedApp' | 'apiVersion' | 'isCustomStoreApp' + | 'future' > { /** * The URL your app is running on. @@ -224,7 +225,7 @@ export interface AppConfigArg< } export interface AppConfig - extends ApiConfig { + extends Omit { canUseLoginForm: boolean; appUrl: string; auth: AuthConfig; diff --git a/packages/shopify-app-remix/src/server/shopify-app.ts b/packages/shopify-app-remix/src/server/shopify-app.ts index a922f440ef..04f970036b 100644 --- a/packages/shopify-app-remix/src/server/shopify-app.ts +++ b/packages/shopify-app-remix/src/server/shopify-app.ts @@ -147,6 +147,7 @@ function deriveApi(appConfig: AppConfigArg) { isEmbeddedApp: appConfig.isEmbeddedApp ?? true, apiVersion: appConfig.apiVersion ?? LATEST_API_VERSION, isCustomStoreApp: appConfig.distribution === AppDistribution.ShopifyAdmin, + future: {}, }); } diff --git a/packages/shopify-app-session-storage-dynamodb/package.json b/packages/shopify-app-session-storage-dynamodb/package.json index 8dabeb65c4..8e4dfde90b 100644 --- a/packages/shopify-app-session-storage-dynamodb/package.json +++ b/packages/shopify-app-session-storage-dynamodb/package.json @@ -37,13 +37,13 @@ "tslib": "^2.4.0" }, "peerDependencies": { - "@shopify/shopify-api": "^8.0.2", + "@shopify/shopify-api": "^8.1.1", "@shopify/shopify-app-session-storage": "^2.0.1" }, "devDependencies": { "@shopify/eslint-plugin": "^42.1.0", "@shopify/prettier-config": "^1.1.2", - "@shopify/shopify-api": "^8.0.2", + "@shopify/shopify-api": "^8.1.1", "@shopify/shopify-app-session-storage": "^2.0.1", "@shopify/shopify-app-session-storage-test-utils": "^1.0.1", "eslint": "^8.40.0", diff --git a/packages/shopify-app-session-storage-kv/package.json b/packages/shopify-app-session-storage-kv/package.json index 7ffdf0e278..1471313ff3 100644 --- a/packages/shopify-app-session-storage-kv/package.json +++ b/packages/shopify-app-session-storage-kv/package.json @@ -36,7 +36,7 @@ "tslib": "^2.4.0" }, "peerDependencies": { - "@shopify/shopify-api": "^8.0.2", + "@shopify/shopify-api": "^8.1.1", "@shopify/shopify-app-session-storage": "^2.0.1" }, "devDependencies": { diff --git a/packages/shopify-app-session-storage-memory/package.json b/packages/shopify-app-session-storage-memory/package.json index 1797832c14..ff1a77153d 100644 --- a/packages/shopify-app-session-storage-memory/package.json +++ b/packages/shopify-app-session-storage-memory/package.json @@ -33,7 +33,7 @@ "tslib": "^2.4.0" }, "peerDependencies": { - "@shopify/shopify-api": "^8.0.2", + "@shopify/shopify-api": "^8.1.1", "@shopify/shopify-app-session-storage": "^2.0.1" }, "devDependencies": { diff --git a/packages/shopify-app-session-storage-mongodb/package.json b/packages/shopify-app-session-storage-mongodb/package.json index 26641e8887..30f93214e6 100644 --- a/packages/shopify-app-session-storage-mongodb/package.json +++ b/packages/shopify-app-session-storage-mongodb/package.json @@ -35,7 +35,7 @@ "tslib": "^2.4.0" }, "peerDependencies": { - "@shopify/shopify-api": "^8.0.2", + "@shopify/shopify-api": "^8.1.1", "@shopify/shopify-app-session-storage": "^2.0.1" }, "devDependencies": { diff --git a/packages/shopify-app-session-storage-mysql/package.json b/packages/shopify-app-session-storage-mysql/package.json index 7176a0be57..a0e7b16642 100644 --- a/packages/shopify-app-session-storage-mysql/package.json +++ b/packages/shopify-app-session-storage-mysql/package.json @@ -36,7 +36,7 @@ "tslib": "^2.4.0" }, "peerDependencies": { - "@shopify/shopify-api": "^8.0.2", + "@shopify/shopify-api": "^8.1.1", "@shopify/shopify-app-session-storage": "^2.0.1" }, "devDependencies": { diff --git a/packages/shopify-app-session-storage-postgresql/package.json b/packages/shopify-app-session-storage-postgresql/package.json index 258b7e48b6..2440da2dc8 100644 --- a/packages/shopify-app-session-storage-postgresql/package.json +++ b/packages/shopify-app-session-storage-postgresql/package.json @@ -37,7 +37,7 @@ "tslib": "^2.4.0" }, "peerDependencies": { - "@shopify/shopify-api": "^8.0.2", + "@shopify/shopify-api": "^8.1.1", "@shopify/shopify-app-session-storage": "^2.0.1" }, "devDependencies": { diff --git a/packages/shopify-app-session-storage-prisma/package.json b/packages/shopify-app-session-storage-prisma/package.json index f216426027..7f7ca4c8bc 100644 --- a/packages/shopify-app-session-storage-prisma/package.json +++ b/packages/shopify-app-session-storage-prisma/package.json @@ -35,13 +35,13 @@ }, "peerDependencies": { "@prisma/client": "^4.13.0", - "@shopify/shopify-api": "^8.0.2", + "@shopify/shopify-api": "^8.1.1", "@shopify/shopify-app-session-storage": "^2.0.1", "prisma": "^4.13.0" }, "devDependencies": { "@prisma/client": "^4.13.0", - "@shopify/shopify-api": "^8.0.2", + "@shopify/shopify-api": "^8.1.1", "@shopify/shopify-app-session-storage": "^2.0.1", "prisma": "^4.13.0", "@shopify/eslint-plugin": "^42.1.0", diff --git a/packages/shopify-app-session-storage-redis/package.json b/packages/shopify-app-session-storage-redis/package.json index 67beb71939..43075cbbb3 100644 --- a/packages/shopify-app-session-storage-redis/package.json +++ b/packages/shopify-app-session-storage-redis/package.json @@ -36,7 +36,7 @@ "tslib": "^2.4.0" }, "peerDependencies": { - "@shopify/shopify-api": "^8.0.2", + "@shopify/shopify-api": "^8.1.1", "@shopify/shopify-app-session-storage": "^2.0.1" }, "devDependencies": { diff --git a/packages/shopify-app-session-storage-sqlite/package.json b/packages/shopify-app-session-storage-sqlite/package.json index f1b5310bc2..ca0d49ef69 100644 --- a/packages/shopify-app-session-storage-sqlite/package.json +++ b/packages/shopify-app-session-storage-sqlite/package.json @@ -36,7 +36,7 @@ "tslib": "^2.4.0" }, "peerDependencies": { - "@shopify/shopify-api": "^8.0.2", + "@shopify/shopify-api": "^8.1.1", "@shopify/shopify-app-session-storage": "^2.0.1" }, "devDependencies": { diff --git a/packages/shopify-app-session-storage-test-utils/package.json b/packages/shopify-app-session-storage-test-utils/package.json index d16235ac82..67af4617f5 100644 --- a/packages/shopify-app-session-storage-test-utils/package.json +++ b/packages/shopify-app-session-storage-test-utils/package.json @@ -38,7 +38,7 @@ "tslib": "^2.4.0" }, "peerDependencies": { - "@shopify/shopify-api": "^8.0.2", + "@shopify/shopify-api": "^8.1.1", "@shopify/shopify-app-session-storage": "^2.0.1" }, "devDependencies": { diff --git a/packages/shopify-app-session-storage/package.json b/packages/shopify-app-session-storage/package.json index df409e996e..a49ca5fb6e 100644 --- a/packages/shopify-app-session-storage/package.json +++ b/packages/shopify-app-session-storage/package.json @@ -34,7 +34,7 @@ "tslib": "^2.4.0" }, "peerDependencies": { - "@shopify/shopify-api": "^8.0.2" + "@shopify/shopify-api": "^8.1.1" }, "devDependencies": { "@shopify/eslint-plugin": "^42.1.0", diff --git a/yarn.lock b/yarn.lock index bc16577c59..3be593120f 100644 --- a/yarn.lock +++ b/yarn.lock @@ -3143,10 +3143,10 @@ jest-matcher-utils "^26.6.2" react-reconciler "^0.28.0" -"@shopify/shopify-api@^8.0.2": - version "8.0.2" - resolved "https://registry.yarnpkg.com/@shopify/shopify-api/-/shopify-api-8.0.2.tgz#765bf03cf0c953ca9c2cde0aae91fba45c6d5def" - integrity sha512-hvVLoEsYglE4GRqFhr9D6oMr2bV6tEdsD9PxuNZ6bYDptoD+kQFKsaP83jE1qtHhB3ve0DeevaVVYjS/2TU7MA== +"@shopify/shopify-api@^8.1.1": + version "8.1.1" + resolved "https://registry.yarnpkg.com/@shopify/shopify-api/-/shopify-api-8.1.1.tgz#d3f400a27d9fe2eaa7647bbd33134b75fe52463a" + integrity sha512-0JO3Mhv9Sb8VKPw/LUdacHJj9wbT/txyByr2TF03yjqoV++G3NxNMUAA1tcpoSvOAv20KlQjwpoFnXqBmPFW7Q== dependencies: "@shopify/network" "^3.2.1" compare-versions "^5.0.3"