Shopify / Shopify/shopify-api-php
Utils::validateHmac() throws an Array to string conversion error
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 473
- Forks
- 193
- Avg merge
- 5h 8m
- Merged PRs (30d)
- 1
Description
Issue summary
When using Utils::validateHmac() to validate the HMAC provided by Shopify for an embedded app, any URLs that contain an associative array trigger an "array to string conversion" error on line 91. This method was refactored in #269 and associative array handling wasn't implemented.
Expected behavior
While it would be nice if this library handled associative arrays properly, I'd be fine implementing them in our project if it was documented anywhere how Shopify handles them. I've tried many, many different variations of encoding an associative array into a URL, but have not been able to get the HMAC to match. It's somewhat common to have URLs like ?filter[status]=live and it would be nice to use them with an embedded app and still be able to verify the HMAC.
Steps to reproduce the problem
- Pass an associative array to
Utils::validateHmac()to reproduce the issue.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Read src/Utils.php at line 91 and the validateHmac path, then inspect the refactor discussion in issue #269 for the intended handling. Reproduce the associative-array query case and add regression coverage; done means validation no longer raises the conversion error and the expected HMAC is verified.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- authentication, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100