Shopify_app: When installing app, the redirect_uri should contain https, but is using http instead on some computers

[gduarte93]

After submitting the form on https://myapp.herokuapp.com/login on my some of my computers, the users will be (correctly) redirected to:

https://mystore.myshopify.com/admin/oauth/authorize?client_id={api_key}&scope={scopes}&redirect_uri=https://mystore.herokuapp.com/auth/shopify/callback&state={nonce}

There, they can login to their store and install the app.

However, on a couple of my computers, the user is redirected, instead, to:

https://{store}.myshopify.com/admin/oauth/authorize?client_id={api_key}&scope={scopes}&redirect_uri=http://myapp.herokuapp.com/auth/shopify/callback&state={nonce}

Where they will see the error Oauth error invalid_request: The redirect_uri is missing or not whitelisted. For some reason on those machines, it is redirecting using http instead of https. Manually adding the 's' into the address bar will allow them to install the app correctly, but how can I make it so that it always uses the https redirect_uri?

Shopify Partners Dashboard:

Callback URL:    https://myapp.herokuapp.com/
Application URL: https://myapp.herokuapp.com/
Redirection URL: https://myapp.herokuapp.com/auth/shopify/callback

Code:

shopify_app.rb

ShopifyApp.configure do |config|
  config.api_key = "my_key"
  config.secret = "my_secret"
  config.redirect_uri = "https://myapp.herokuapp.com/auth/shopify/callback"
  config.scope = "read_orders, read_products" # install assets/snippets?
  config.embedded_app = true
end

omniauth.rb

Rails.application.config.middleware.use OmniAuth::Builder do
  provider :shopify,
    ShopifyApp.configuration.api_key,
    ShopifyApp.configuration.secret,
    redirect_uri: ShopifyApp.configuration.redirect_uri,
    scope: ShopifyApp.configuration.scope
end

routes.rb

Rails.application.routes.draw do

  controller :sessions do
    get 'login' => :new, :as => :login
    post 'login' => :create, :as => :authenticate
    get 'auth/shopify/callback' => :callback
    get 'logout' => :destroy, :as => :logout
  end

  root :to => 'home#index'

end

[kevinhughes27]

Nice issue write up - that is really quite bizarre.

To clarify you are seeing the issue with your app deployed to Heroku and using different computers to install the app on a shop? I just want to rule out different gem versions if this was done locally.

[christianblais]

Did you change these settings recently? Could your "other computers" had cookies previously set with another URL?

[gduarte93]

To clarify you are seeing the issue with your app deployed to Heroku and using different computers to install the app on a shop? I just want to rule out different gem versions if this was done locally.

• kevinhughes27

Correct.

Did you change these settings recently? Could your "other computers" had cookies previously set with another URL?

• christianblais

I just deleted all of the cookies on Chrome, Firefox, and Safari on my main computer. The redirect_uri appears correct on Chrome and Firefox, but now Safari will use http instead. I also deleted the cookies for Chrome on one of the computers that was not working before, and it still does not work.

[gduarte93]

Actually, with the cookie thing, I deleted them again for Chrome and Firefox, but this time made sure to quit out of them. When trying to install the app this time, it uses http for both browsers on my main computer. So I would get the Oauth error.

I switched config.redirect_uri = "https://myapp.herokuapp.com/auth/shopify/callback" to config.redirect_uri = "http://myapp.herokuapp.com/auth/shopify/callback" in shopify_app.rb and changed the Redirection URL on the Partners Dashboard to match. After doing this, the app seems to be able to install on all my computers.

I guess the redirect_uri always uses http, regardless of what I use in shopify_app.rb? And somehow some of the computers received cookies that include https.

[christianblais]

Try the same, changing everything to https, both in config and in the partner area, then clear all your cookies again. Does it work?

[thatdom]

I had same problem, updated gem to 6.3.0 (I was on 6.2.1) and now it seems to work.

[kevinhughes27]

I had this issue on an app yesterday that doesn't use this framework - I wonder if the issue might be on Shopify side. I solved by adding both the http and https urls in the partners area.

[gduarte93]

@kevinhughes27 This is what I ended up doing, and it seems to work

[wnm]

@gduarte93 I had the same issue in my app, and looked around the code a little bit. As a said in #203, I think the gem omniauth-shopify-oauth2
is expecting an option called callback_url. Not redirect_uri. See https://github.com/Shopify/omniauth-shopify-oauth2/blob/d4f119be212a1e259e291621f07259e956accfff/lib/omniauth/strategies/shopify.rb#L114

Can you test these settings:

omniauth.rb

Rails.application.config.middleware.use OmniAuth::Builder do
  provider :shopify,
    ShopifyApp.configuration.api_key,
    ShopifyApp.configuration.secret,
    callback_url: ShopifyApp.configuration.redirect_uri,
    scope: ShopifyApp.configuration.scope
end

I don't think it has anything to do with #213

[jasonbuehler]

I am having this issue, and am on version 7.0.2 of the gem. redirect_uri is not a configuration, so no dice there. Anyone still having this issue? I had it with the gem as far back as versions in the 5s, eventually I just rewrote the redirect_to_login method in my controller to redirect to a full url with secure protocol. This seems to always happen redirecting through /login for me.

[wnm]

@jasonbuehler did you try calling it callback_url in your config, as the example above?

[jasonbuehler]

@wnm yes, an error is thrown since ShopifyApp.configuration.redirect_uri is not part of the configuration.

[kevinhughes27]

Yes this was removed since you no longer need to set the redirect_uri parameter.

@jasonbuehler can you share exactly what you did? It sounds interesting.

[jasonbuehler]

@kevinhughes27 I created a new app using the generators provided. I have been copying some relevant logic over from another app to shortcut a bit of the boilerplate app logic, but I don't think I copied over anything that pertained to the authentication. The problem is fleeting, I will be trying to load my dev shop admin and it blocks the iframe due to a mixed content warning as it is trying to load /login to authenticate my app I assume. Is there anything specific I can put in here that you would care to see?

[kevinhughes27]

@jasonbuehler that is the browser blocking the content. Recently chrome seemed to get more strict about this and the allow unsafe content button doesn't fully fix it anymore. (for development). I do all my ShopifyApp work behind a forwarding service like ngrok now which solves the mixed content problem.

[jasonbuehler]

@kevinhughes27 Ya, it is a problem though on production as well, since it is trying to go through http://.../login, the browser blocks the auth request. Is there a way that you know of to strictly enforce https? I have certs set up locally too but it sometimes uses https, sometimes not.

[wnm]

I vaguely remember that I had that issue too, but somehow fixed it. Can you confirm that you a) have an https url as config.redirect_uri parameter in config/shopify_app.rb and b) have the same https url in your app settings as redirection url at https://app.shopify.com/services/partners/api_clients/YOURAPP/edit?

[jasonbuehler]

@wnm config.redirect_uri is not part of the config anymore so I can't include it in the shopify app configuration. I have both the http and https version of the redirection url in my app settings due to this bug.

[wnm]

it isn't? then try changing the omniauth setting directly?

Rails.application.config.middleware.use OmniAuth::Builder do
  provider :shopify,
    ShopifyApp.configuration.api_key,
    ShopifyApp.configuration.secret,
    :callback_url => "https://yourredirecturi.com",
    :scope => ShopifyApp.configuration.scope
end

[kevinhughes27]

@wnm yeah setting the redirect_uri param never did anything. You can specify the callback url like that but omniauth will do this automatically

[jasonbuehler]

@wnm this solves my issue of having to maintain 2 separate callback urls in the app settings, so awesome there. I feel like this isn't going to solve my issue with /login trying to authenticate through http tho. I am actively working on a new app so if and when I run into the /login issue I will try to post details here.

[CodeBrotha]

Had the same https issue today. Gem version 7.2.8.

[fones]

Same here (7.2.8). When using ngrok.io to proxy to my localhost over HTTPS and it works fine. But on production got redirect with http. Same configuration, same code. Strange.

I have added callback_url: "https://your-all-url.com/auth/shopify/callback" to config/initializers/omniauth.rb and it works.

[morales257]

Same here (7.0.2) used @fones tip and added callback_url to omniauth.rb

[kevinhughes27]

If you are starting a new app I would strongly recommend the latest version of the gem (its also the easiest version for us to support)