This repository has been archived by the owner on Nov 30, 2022. It is now read-only.
Always pass the filtered query params to the token redirect #785
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
onurkose
pushed a commit
to onurkose/laravel-shopify
that referenced
this pull request
Jun 25, 2021
gnikyt
added a commit
that referenced
this pull request
Jun 25, 2021
* Combined AuthShopify, AuthToken into new VerifyShopify middleware * SessionToken value object created to verify and validate all aspects of the JWT * New unauthenticated route and view added * Removal of ITP, cookie helper, shop session as they're unneeded * Added Polaris skeleton to token view * Revised initial package landing page * Added session ID support * Moved AuthorizeShop to InstallShop * Condensed InstallShop and modified to return an array * Modified InstallShop to track access token update time * Modified Shop command to track access token update time * Support for other routes and token usage * Removed authenticate.oauth route * Removed oauthfailure method on authenticate controller * Removed ShopSession class * Updated shopify-config to reference new authenticate routes (install, token) * Updated shopify-config to remove old authenticate routes * Updated ShopModel's getToken to getAccessToken for naming conflict purposes * Removed old ITP and authenticate routes from built-in route provider * Updated SHOPIFY_API_REDRIECT to use /install instead of old /authenticate * Revert authenticate route back to authenticate instead of 'install' * Updated test class naming for DeleteWebhooks action * Added TurboLink support * Change name for test package * Added getToken helper * Added missing auth url exception * Added billing to allowed routes, change token receipt * Exception added to prevent loop redirects if authorization link is empty * Added billing payments with tokens * Removed unused classes * Added test cases for session token * Test cases added for session context, verify shop middleware * Check for "?" in URLs instead of "&" when determining the separator (#777) * Fix test: use `authenticate.token` instead of `authenticate.oauth` (#776) * Use `contains()` to support route prefixes (#775) * Use an env var for the new `turbo_enabled` config setting (#774) * Updated code to use AuthManager from Laravel instead of auth() * Updated response codes to use HTTP constants * Update to BillingController and Billable middleware to remove old ShopSession service * Remove "token" from the query string of the target URL (#779) * Feature/cookieless - changes for turbolinks, install app (#780) * Redirect if the user clicked on any link before load Turbo * Find shop domain in request when getting the token (#784) * Add param to constructor to optionally not verify the token * Add static method `ShopDomain::getFromRequest()` to find the shop domain * Remove extraneous `ShopDomain` calls * Always pass the filtered query params to the token redirect (#785) * Added TokenRedirect macro for Laravel Redirect * Added TokenRoute macro for Laravel URL/Route * Updated ShopDomain::getFromRequest to be ShopDomain::fromRequest for consistency * Moved HMAC and HMAC generation/comparison to value object (Hmac) * Move SessionContext to be a composite value object * Updated to handle Blade session tokens * Added Blade directive "@sessionToken" * Added support for jQuery, Turbolinks, and Axios for token bearer * Added support for ".session-token" to automatically update with the token value * Update jQuery ajax header Authorization setting (#790) * Use template style setting for jQuery.ajaxSetup * Use window.jQuery.ajaxSettings.headers = { } instead of ajaxSetup method * Clean up on bearer token header settings * Remove legacy factories package * Billing flow adjusted to use tokens * Fix to Kernel testcase referring to old middleware * Fix to undefined methods for macros * Remove build and bin folders from repo * Added test for `tokenRoute` * Added test for `tokenRedirect` * Modified `TokenRedirect` and `TokenUrl` macros to use a common base class * Added test for sessionToken directive * Fix to SessionContext validity check for domain comparison * Resolve static method not found for tests on tokenRedirect and tokenRoute Co-authored-by: Lucas Michot <lucas@semalead.com> Co-authored-by: Vitaly <32259003+Enmaboya@users.noreply.github.com> Co-authored-by: Scott Carpenter <scott@payforstay.com> Co-authored-by: Tyler King <osiset@users.noreply.github.com> Co-authored-by: Vitaliy Dubov <vdubov@simtechdev.org> Co-authored-by: Stephen Sweetland <steve.sweetland@gmail.com> Co-authored-by: Tony Le <55417634+thang12l@users.noreply.github.com> Co-authored-by: Lucas Michot <lucas@semalead.com>
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
I noticed that my routes that had query params were losing the query params when they were going through the token redirect route. The only way the query params were being passed through is if they included "hmac". This PR makes it so that query params (filtered) are always passed through to the token redirect route.
One thing to note is that I changed
$request->all()to$request->query(). I couldn't think of any reason to useall()because that includes POST params, file keys, etc. Converting everything to query params could potentially cause some problems.