Shopify_app: Feature Request: Add support for multiple shop sessions
Feature Request
The shopify_app gem only supports usage within a single shop, and should offer a way to support multiple shop sessions at the same time.
Rationale
If a user logs into an app on a shop, say Shop 1, and then logs in to the app using a different shop, say Shop 2, their session from Shop 1 is cleared and no longer valid.
It is up to app developers to add a layer of authentication on top of the login flow to ensure that a user is seeing data for the correct shop and operating on the correct shop.
The gem should offer a solution to limiting sessions to the current Shop.
Problems caused because of a lack of multi-shop support:
- A user might see data for Shop 2 on Shop 1 if an app uses the shop_id from the session to identify the shop.
- If a user logs out of Shop 1, but they have valid shopify session data set for Shop 2, apps could allow them to continue to have access to their data for Shop 1 unless they have shop specific checks.
- If a user loads the app in two or more shops at the same time, they run into race conditions with the authentication flow. They could end up seeing Shop 2's view on Shop 1 and failing the authentication flow on one of the other shops.
Benefits of supporting multi-shop use in the gem:
- Providing a recommended pattern for app developers to support multi-shop use makes it easy for developers to secure their app and follow best practices.
- This will make it faster and easier for developers to upgrade for fixes and improvements. If developers have to build their own custom shop-specific authentication on top of the authentication in
shopify_app, this could mean a slower and more tedious upgrade to ensure that their custom overrides still work.
Possible solutions:
Individual Session Paths for each shop:
- @EiNSTeiN- has suggested scoping every shop to a specific path (for example
/shop_id/), and using session paths to create different sessions per session path: https://github.com/Shopify/shopify_app/issues/502#issuecomment-342206871
Related Issues
surajreddy
>All comments
For embedded apps, every request comes with shop, hmac and a few other fields added to the query string. You could imagine using those to load and authenticate the correct shop, instead of the session.
For non-embedded apps, you'd probably want to have the shop id or hostname in url somehow. I don't think that would actually work, though, because AFAIK the app url setting in the partners' dashboard only takes a static url.
Now that I think about it, that's probably why this gem uses the session and cookies for authentication instead of the shop, hmac and timestamp that come with the request for embedded apps - so that it works for non-embedded apps. It would be a nice feature addition to use those for embedded apps though. I bet it would make at least a few merchants happy, since right now it probably seems like an annoying bug to them.
mikeyhew
on 26 Feb 2019
Related issues
resistorsoftware
路
8Comments
chintanparikh
路
5Comments
marisveide
路
5Comments
quocble
路
8Comments
wlbrough
路
6Comments
Most helpful comment
For embedded apps, every request comes with
shop,hmacand a few other fields added to the query string. You could imagine using those to load and authenticate the correct shop, instead of the session.For non-embedded apps, you'd probably want to have the shop id or hostname in url somehow. I don't think that would actually work, though, because AFAIK the app url setting in the partners' dashboard only takes a static url.
Now that I think about it, that's probably why this gem uses the session and cookies for authentication instead of the
shop,hmacandtimestampthat come with the request for embedded apps - so that it works for non-embedded apps. It would be a nice feature addition to use those for embedded apps though. I bet it would make at least a few merchants happy, since right now it probably seems like an annoying bug to them.