Merge pull request #477 from Paritoshyadav/my-new-feature

Fix shopify hmac validation by inculding host params
markbates · Oct 26, 2022 · 0aa0078 · 0aa0078
2 parents 45d69da + 36399aa
commit 0aa0078
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/providers/shopify/session.go b/providers/shopify/session.go
@@ -43,8 +43,9 @@ func (s *Session) Authorize(provider goth.Provider, params goth.Params) (string,
 	// Validate the incoming HMAC is valid.
 	// See: https://help.shopify.com/en/api/getting-started/authentication/oauth#verification
 	digest := fmt.Sprintf(
-		"code=%s&shop=%s&state=%s&timestamp=%s",
+		"code=%s&host=%s&shop=%s&state=%s&timestamp=%s",
 		params.Get("code"),
+		params.Get("host"),
 		params.Get("shop"),
 		params.Get("state"),
 		params.Get("timestamp"),