
Security News
libxml2 Maintainer Ends Embargoed Vulnerability Reports, Citing Unsustainable Burden
Libxml2’s solo maintainer drops embargoed security fixes, highlighting the burden on unpaid volunteers who keep critical open source software secure.
io.github.blackmo18:kotlin-shopify-authentication-jvm
Advanced tools
Csv File to Kotlin Data Class Parser
#Kotlin-Shopify Authentication
Simple Straightforward Authentication Library for Shopify Application Setup in Kotlin
##Features
implementation("io.github.blackmo18:kotlin-shopify-authentication-jvm:0.1.0")
<dependency>
<groupId>io.github.blackmo18</groupId>
<artifactId>kotlin-shopify-authentication-jvm</artifactId>
<version>0.1.0</version>
</dependency>
val SHOPIFY_CONTEXT = authenticationSetup {
apiKey = "your_app_key"
apiSecret = "your_app_api_secret_key"
host = "your_server_host_url"
scopes = listOf( // declare your access scopes here
"read_products",
"write_products",
"read_customers",
"read_orders",
"write_orders",
"read_fulfillments",
"read_checkouts",
"read_locations",
"read_draft_orders",
"read_shopify_payments_disputes",
"read_script_tags",
"write_script_tags"
)
accessType="offline" // declare you access whether online or offline
}
val WEBHOOK_SETUP = webhookInstallationSetup(SHOPIFY_CONTEXT) {
topics = listOf(
"carts/create",
"carts/update"
...
)
}
a.) authenticateInstall(callingURL: String)
validates incoming request from shopify and exposes a callback function that determines whether the request is valid.
isValid
flag wether the call is validredirect
should be returned if the call is validb.) onInstallRedirect(callingURL: String)
validates incoming request from shopify on app install, determines whether the request is valid.
isValid
redirect
should be returned if the call is valid or override redirect urlc.) registerHooks(shopAccessToken: String, shopDomain: String)
register all webhook topics declared in Webhook Setup
a.) note that when a webhook is created, it will register the endpoint to the following format to shopify
{your url HOST}/api/webhook/{webhook_topic}
so you must CAREFULLY match your endpoint to the latter format
b.) ShopifyAuthUtils.validateWebhookCall(payload: String, apiSecret: String, hmac: String)
validates whether the incoming webhook call actually came from shopify
routing {
get("/") {
SHOPIFY_CONTEXT.authenticateInstall(call.request.uri) { isValid, redirect ->
when {
isValid -> call.respondRedirect(redirect!!)
else -> call.response.status(HttpStatusCode.Unauthorized)
}
}
}
get("/auth/callback") {
val response = SHOPIFY_CONTEXT.onInstallRedirect(call.request.uri) {
isAuthenticated, redirect ->
when {
isAuthenticated -> call.respondRedirect(redirect!!)
else -> call.response.status(HttpStatusCode.Unauthorized)
}
}
when (response.code) {
ResponseStatus.SUCCESS -> {
response.data?.run { WEBHOOK_SETUP.registerHooks(access_token, shop) }
}
else -> {
TODO("nothing")
}
}
}
post("/api/webhook/carts/create") {
val hmac = call.request.headers["x-shopify-hmac-sha256"]
val payload = call.receiveText()
val validated = ShopifyAuthUtils.validateWebhookCall(payload, SHOPIFY_CONTEXT.apiSecret, hmac!!)
when {
validated -> {
call.respond("ok")
println("validated carts/create api call")
}
else -> {
call.response.status(HttpStatusCode.Unauthorized)
println("invalidated carts/create api call")
}
}
}
}
FAQs
Unknown package
We found that io.github.blackmo18:kotlin-shopify-authentication-jvm demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Libxml2’s solo maintainer drops embargoed security fixes, highlighting the burden on unpaid volunteers who keep critical open source software secure.
Research
Security News
Socket researchers uncover how browser extensions in trusted stores are used to hijack sessions, redirect traffic, and manipulate user behavior.
Research
Security News
An in-depth analysis of credential stealers, crypto drainers, cryptojackers, and clipboard hijackers abusing open source package registries to compromise Web3 development environments.