CODEWITHSUNDEEP
shopifyaccess-tokenshopify-app
JohnyFree
JohnyFree

Reputation: 1369

Shopify app access token - how to make it more secure?

When store owner installs my app I save access tokens into database for later use. Having access tokens from store is huge security responsibility because anybody with these tokens can modify stores from any domain/address, there is no ip or domain lock.

What method could I use to make this more secure? I was thinking to save tokens offline and then upload it only when needed (in case I need to make some global updates for all stores), then delete it again. In case when merchant access app configuration within admin, I would just save it into session. Is there any better method?

Upvotes: 3

Views: 3217

Answers (1)

drip
drip

Reputation: 12943

Good question.

I save them in a database as well but I encode them with a separate key from the Shopify App password. That way even if someone have access to the database because of some backdoor entrance he won't be able to use them. That said if someone have access to the code he will be able to figure out how to decrypt it since he will have access to the key.

That said I make sure that each and every request is authenticated before I show any response from the server. Since I'm using NodeJS as the back-end I make sure that there are no global variables that can be accessed or modified from different stores. Everything is neatly scoped in separated functions so that the session is scoped for the current store and no other ones will be able to dirty the other store session.

In addition I make sure that there is a webhook that fires when the client uninstall his app in order to clear my database from any information regrading his store.

I know some people are using sessions for this ( online method ) but they pose other problems that I didn't like so I stuck with a database ( offline ) since that is the quicker way to access the App instead of multiply redirects in order to save the session.

As for proposals I can give you a few tips that I learn on my way while building a few basic Apps. ( I'm not an expert on the subject by any means )

  • don't rely on any cookies when it comes to sensible information
  • authenticate every request that comes from the front-end
  • don't trust the user and validate any input that comes from the front-end
  • don't over-complicate your setup, while it's good to have high security it's bad if it makes your app slow for the user and you lose customers
  • look to other ready to use popular solutions that can guide you to the correct path
  • don't get greedy with the App scopes, only request the scopes that you need for you app
  • remember to clean up after yourself when it's possible but don't over do it ( too many Apps modify the code of customers and break it only to prevent any way to clean it afterwards ) Example use the ScriptTag API instead of a liquid snippet using the Asset API. If you have to use the Asset API add only the parts that you know that won't break a site. Creating a variable is ok if you are using var if the site supports IE11 creating a variable using const or let is not OK or using vanilla JS is OK but using jQuery without knowing for sure that the site has it installed globally is not OK.

More insights on the matter can be seen here:

https://help.shopify.com/en/api/getting-started/authentication/oauth/api-access-modes https://community.shopify.com/c/Shopify-APIs-SDKs/Best-way-to-store-shops-that-have-installed-my-app-and-their/m-p/402972

Upvotes: 9

Related Questions