module ShopifyGraphql::PayloadVerification

Private Instance Methods

hmac_valid?(data) click to toggle source
# File lib/shopify_graphql/controller_concerns/payload_verification.rb, line 11
def hmac_valid?(data)
  secrets = [ShopifyApp.configuration.secret, ShopifyApp.configuration.old_secret].reject(&:blank?)

  secrets.any? do |secret|
    digest = OpenSSL::Digest.new('sha256')
    ActiveSupport::SecurityUtils.secure_compare(
      shopify_hmac,
      Base64.strict_encode64(OpenSSL::HMAC.digest(digest, secret, data))
    )
  end
end
shopify_hmac() click to toggle source
# File lib/shopify_graphql/controller_concerns/payload_verification.rb, line 7
def shopify_hmac
  request.headers['HTTP_X_SHOPIFY_HMAC_SHA256']
end