Fix shopify hmac validation by inculding host params

markbates · Oct 25, 2022 · 36399aa · 36399aa
1 parent 45d69da
commit 36399aa
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/providers/shopify/session.go b/providers/shopify/session.go
@@ -43,8 +43,9 @@ func (s *Session) Authorize(provider goth.Provider, params goth.Params) (string,
 	// Validate the incoming HMAC is valid.
 	// See: https://help.shopify.com/en/api/getting-started/authentication/oauth#verification
 	digest := fmt.Sprintf(
-		"code=%s&shop=%s&state=%s&timestamp=%s",
+		"code=%s&host=%s&shop=%s&state=%s&timestamp=%s",
 		params.Get("code"),
+		params.Get("host"),
 		params.Get("shop"),
 		params.Get("state"),
 		params.Get("timestamp"),