iFrame Security Headers not getting added in response headers about laravel-shopify HOT 6 CLOSED

I assume you are getting an app rejection?

I've seen this happen with Blade because of the redirect that happens after OAUTH to the authenticate/token route. Shopify only want users to be directed to the app homepage but blade needs that route in between to get the JWT token.

There's no current solution that I know of apart from making your app run like an SPA using Livewire or similar.

Edit: I do see on a test version that the headers are not being set in the latest version. It looks like the middleware is not firing although it is being registered.

from laravel-shopify.

from laravel-shopify.

I've created a new PR which seems to fix the issue. If the tests pass, I will release a new patch later on.

#56

from laravel-shopify.

@mohd-baquir-qureshi, if you want to fix this before the patch, you can add this line of code to your kernel.php under the 'web' middleware group:

\Osiset\ShopifyApp\Http\Middleware\IframeProtection::class

Example:
File: app/Http/Kernel.php

'web' => [
            \App\Http\Middleware\EncryptCookies::class,
            \Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse::class,
            \Illuminate\Session\Middleware\StartSession::class,
           ............
            \Osiset\ShopifyApp\Http\Middleware\IframeProtection::class, //<----- Add this at the end
        ], 

from laravel-shopify.

@mohd-baquir-qureshi the PR is out, and you can update the package or you cant use my solution above. If the issue is resolved then close this bug..

from laravel-shopify.

This should be fixed now in 17.4.3 so closing but re-open if it still happens after upgrading.

from laravel-shopify.