Approving recurring billing throws SignatureVerificationException using BLADE frontend_engine config

[CetoBasilius]

Approving recurring billing throws SignatureVerificationException using BLADE frontend_engine config

[CetoBasilius]

Hi @Kyon147, i can confirm it's https and that was not the problem, using valet + ngrok. Debugged yesterday, the hmac calculation breaks when it receives the host and billing params when billing redirects to home.

I added a small detection on the BillingController trait so that it checks if the frontend_engine flag is set to REACT, if so, it does add the params. I added another test case modifying the flag so that your changes continue to work on PR #1263

Reading the "Outdated App" issue seems we will all be headed towards a SPA anyway so I'm not sure if this PR will be merged

[CetoBasilius]

@Kyon147 Seems removing the host and billing (Line 96, 97) from the 'route_names.home' redirect, from src/Traits/BillingController.php in your last commit 695f968859be1bf041c5b1df8d67640502e5ce1a Fixes this,

I imagine these were put in to fix something else, why were these put in?

[CetoBasilius]

@Kyon147 Saw that your changes are important and relevant for the new flag frontend_engine so i used the Util::useNativeAppBridge() function to determine if host and billing params are sent.

Separated the test case in 2 different scenarios

Don't know if this is the optimal solution but it works for both cases. @osiset what would be your comments?

[CetoBasilius]

Just saw the discussion at #1250 so this might not be added after all from what i see

[Kyon147]

Hi @CetoBasilius

Thanks for the detailed bug report.

I have seen Shopify uses the url that you enter in your app partner config as the url to target for auth etc, can you confirm you have added https and not http.

I can't see any reason why adding the host param on the billing route would break the BLADE route, as the existing param is still there shop and one was just an addition.

The param was added because it is needed for AppBridge once you are redirected back from Shopify's bulling screen otherwise the app won't load correctly because AppBridge can't initialise again. This happens when using SPA more than Blade as Blade templates use the auth.token middleware.

[Kyon147]

I do remember someone else mentioning this last week with a potential fix, I just can't find the comment.

Will do a little digging to see if that fix worked for them.

[d-shannon]

If anyone needs a quick hacky fix, I am catching the exception in Handler.php and redirecting to home route.

[nonghinh]

Same issue