All notable changes to this project will be documented in this file.
The format is based on Keep a Changelog and adheres to Semantic Versioning.
- Make sure the bundled package includes the App Bridge lib 150, fixes missing files from v5.0.0-5.0.2
⚠️ [breaking] Upgraded@shopify/shopify-api
version 149- See the library release notes for details on the breaking changes. By default, apps should only need to make changes to usages of
Shopify.Webhook
since other breaking changes are internally handled by this package.
- See the library release notes for details on the breaking changes. By default, apps should only need to make changes to usages of
- Replace deprecated EASDK call with App Bridge 148
- Replace deprecated metafields API request used for oauth token check with longer lived call to the shop endpoint 144
- Retry OAuth if cookie / session has expired on callback 112
- Fix authentication error if the Shopify session ended before its expiration date 94
- Remove
samesite=none
setting fromcookie-options
. 83
- Bumped
@shopify/shopify-api
version to v1.2.1 to include the new API version (April21
). 80
- Add
returnHeader
option toverifyRequest
, which allows using the middleware on XHR requests. 78
- Fix bad import path for type AccessMode. 63
- Ensure both
shopifyAuth
andverifyRequest
work in offline mode. 59
- Sets the
USER_AGENT_PREFIX
onShopify.Context
for usage tracking data. 55
- [Feature] Start using the new Shopify library instead of implementing all of the server-side functions. 54
- Sets the
USER_AGENT_PREFIX
onShopify.Context
for usage tracking data. 51
- [Feature] Add missing associated user data to the session 23
- Fix inconsistency in authentication path prefix to remove trailing slash 29
- Bad release (misaligned tags). Please use
3.1.72
instead.
- No changes from 3.1.68
- Moved to standalone repository
- Bad release. Please use 3.1.70 instead.
- Wrap
encodeURI
values in double quotes 1613
- URI encode
config
on redirection page 1612
- Include
prefix
when redirect to the root endpoint 1498
- Protect against reflected XSS vulnerability 1455
- Include
prefix
when we redirect to the/auth
path.
- Fixes ITP 2.3 and Safari 13.1 enable cookies loop 1413
- Package now forces cookies.secure to be true 1255
- Package sets cookies to samesite:none and secure 1251
- Updated redirect script to use App Bridge 1242
- No longer errors out on fresh installs with no session 1022
- Package no longer allows sessions from one shop to bleed over into another 940
- Package now lists missing '@shopify/network' dependency 862
- Installation no longer fails if accessToken is invalid #844
- OAuth route no longer rejects uppercase shop domains #493
- HMAC validation no longer breaks when params are unsorted #451
- Start of Changelog