Shopify_app: Authentication failure! csrf_detected

[ghost]

Hi,

I am trying to build my first app, and everything works fine —I get into the app install page, the database adds the new store, and I get redirected to the app page inside the admin panel— but then I get an:

ERROR -- omniauth: (shopify) Authentication failure! csrf_detected: OmniAuth::Strategies::OAuth2::CallbackError, csrf_detected | CSRF detected

Any idea from where that could be comming from?

I am using ruby '2.2.1' and rails '4.2'. Running in localhost using thin to have an https connection. My Callback URL is http://test-shopify-app.dev:3000/auth/shopify/callback.

Thanks in advance for your help. I have been stuck with this bug for a day, and I don't know what else to try...

[kevinhughes27]

Try putting your callback url as https. Also did you use the generator? There is some rails config required for using the ESDK that it takes care of

[ghost]

Thanks @kevinhughes27 for your quick reply. I changed to https but I am still having the same issue with the csrf. I also used the generator (rails generate shopify_app). Any other thing you might think it could be?

[kevinhughes27]

Is everything set properly on the app page in the partners area? I've never seen this before with the gem so I am not too sure

[ghost]

Yes, I think so:

I think I am going to start the rails app from scratch again and see if it still happens.

[kevinhughes27]

there is a checkbox for using the ESDK - is that checked?

[ghost]

Yes:

[kevinhughes27]

hmm sorry I can't be more help!

[ghost]

Thanks anyhow. I will let you know if I figured it out.

[ghost]

I figured out my problem! I was using for both Application URL and Redirection URL: https://test-shopify-app.dev:3000/auth/shopify/callback.

And it needs to be, for Application URL: https://test-shopify-app.dev:3000 and for Redirection URL: https://test-shopify-app.dev:3000/auth/shopify/callback.

That's it. I am closing this issue. Thanks @kevinhughes27 for your help.

[kevinhughes27]

I'm glad you got it figured out! getting all the auth stuff done is never fun!

[hirowatari]

Thanks @guillelopez for coming back and posting your solution. Had the same issue today.