Repository: Shopify/shopify_app

Issue #1181: Per user auth from app list redirect with session query parameter
Created: 2021-02-08T03:21:39Z
Hi folks, Thanks for your work on this gem!
I've had non-embedded Shop session authentication working for years, and have been trying to follow the instructions for adding per-user session. I have it working when I use my own login page, however, when I click the link from a list of a shop's installed apps, I end up in an infinite loop.
From my research, the installed app list link redirects to app's URL with a session value in the query params.  From some debugging, it appears that session query param is tripping up part of LoginProtection.  After a successful Oauth login, shopify_app returns to the original URL that has the params[:session].  However, in LoginProtection the session[:user_session] from Oauth does not match the params[:session] from the redirect query string, triggering the session to be cleared, and login is forced again.  1. Successful login.  2. redirect to return URL. 3. sessions don't match in LoginProtection.  4. clear session.  Repeat.
I would guess that session param from the app list redirect should match the Oauth session?
Or should I be authenticating differently from the app list URL that has the session param?
What am I missing?
Thanks!
# shopify_app/lib/shopify_app/controller_concerns/login_protection.rb

def login_again_if_different_user_or_shop
   if session[:user_session].present? && params[:session].present? # session data was sent/stored correctly
     clear_session = session[:user_session] != params[:session] # current user is different from stored user
   end
...

Duplicate issue #1333: Infinite login redirect when installed in sub-directory / folder.
Created: 2021-11-09T01:31:17Z
We are running into issues with infinite loops that result in the following error when trying to run the app in a folder/directory instead of at the root of our domain:

The app couldn’t be loaded
This app can’t load due to an issue with browser cookies. Try enabling cookies in your browser, switching to another browser (opens a new window), or contacting the developer to get support.

We are able to reproduce this with a fresh demo app as well. We are running JWT authentication and have cookie based auth disabled. Versions of software used:

Ruby 3.0.2p107
Rails 6.1.4.1
shopify_app gem v18.0.2
Apache 2.4.48
Passenger 6.0.4

In our Apache config we have both PassengerBaseURI and RackBaseURI set to our folder, say /our-app-name. We also added this to shopify_app.rb initializer under the config.root_url = '/our-app-name' config option.
The first issue we are presented with is that the redirect that happens due to the post_redirect_to_auth_shopify.html.erb file included in the engine forces a redirect to /auth/shopify without any awareness of Rails relative_url_root configuration option or the ShopifyApp engine's own root_url option I referenced above. So immediately our OAuth cycle gets removed from the directory our app lives in and breaks.
I tried fixing this by adding that file to my own app under app/views/shopify_app/post_redirect_to_auth_shopify.html.erb and prefixing it like so:
<%= form_tag "#{main_app.root_path}auth/shopify", id: 'redirect-form' %>
This allows it to continue the authentication cycle, but then the next issue we run into is the following error:

Oauth error invalid_request: The redirect_uri is not whitelisted

This is because by prefixing the shopify auth path in the prior step, this doubles up the directory in the redirect_uri parameter, resulting in this: redirect_uri=https%3A%2F%2Fdomain.com%2Four-app-name%2Four-app-name%2Fauth%2Fshopify%2Fcallback
The final step I tried when running into this was the following configuration option in omniauth.rb:
callback_path: "/auth/shopify/callback"
This allows the full authentication flow from what I can tell as it seems to strip the duplicate folder name from the callback_uri parameter. However this is what triggers the infinite loop that then leaves us with ultimately the same original error about allowing third party cookies.
Again, this all works fine if we change the settings in both our app and in the shopify app settings in Shopify's developer portal to not have our app nested in a folder. The issue seems to be only with once we nest our app within a folder/subdirectory.

Closing comment (2021-12-06T18:55:32Z): May be related to #1181