shopify-hmac-validation

BREAKING CHANGE

if you were previously using common JS : const checkHmacValidity = require('shopify-hmac-validation')

this will now need to either be imported as default or implicitly. const checkHmacValidity = require('shopify-hmac-validation').checkHmacValidity or const {checkHmacValidity} = require('shopify-hmac-validation')

Only named exports are now provided. Implicitly load them.

If you woulpod prefer to use the older version please use: version 1.0.4 however this is old and does include a minor security alert for outdated packages.

Why was this changed? This was changed to allow space for additional methods to be surfaced for validating Webhook Hmacs and body conversion to achieve this from parsed values.

Overview

1. checkHmacValidity : Installation hmac validation
2. checkWebhookHmacValidity : Webhook validation
3. createRawBody : NextJS helper to save from turning off parser on api routes.

Usage: checkHmacValidity

1. Installnpm install shopify-hmac-validation --save
2. Import const checkHmacValidity = require('shopify-hmac-validation').checkHmacValidity
3. Pass it your APP Secret ( partners.shopify.com)
4. PAss it either a querystring object or simply the string it will figure it out (location.search)
5. Response will simply be a bool, true if they match, false if not

Example:

checkHmacValidity("SOMEKEY","SOMESTRING or {SOMEOBJECT}")

In the github is a test that has a valid test object and string if you would like to reference that other wise I will place a more indepth docs out in time.

Usage: checkWebhookHmacValidity

1. Installnpm install shopify-hmac-validation --save
2. Import const checkHmacValidity = require('shopify-hmac-validation').checkWebhookHmacValidity
3. Pass it your APP Secret ( partners.shopify.com) 3.1 Pass it the raw body of the webook request 3.2 Pass in the hmac from the headers x-shopify-hmac-sha256
4. Response will simply be a bool, true if they match, false if not

Usage: checkHmacValidity

1. Installnpm install shopify-hmac-validation --save
2. Import const createRawBody = require('shopify-hmac-validation').createRawBody
3. A request.body object ( useful with next js body parsed rer)
4. Response will simply be a string that can be used as the raw body in webhook validation

Other packages:

With shopify adding JWT verification for calls from front to backend I have added a package to help out: Shopify App JWT Verification This may come in handly if you are using this for auth out front of your app and need a helper for other verification :)