Shopify / Shopify/shopify_python_api
Signature validation should support validating with an old secret
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 1.4k
- Forks
- 388
- Avg merge
- 5h 39m
- Merged PRs (30d)
- 1
Description
Problem
Oauth2 signature validation will fail when during credential rotation, since the signature is generated with the oldest secret, and validation can only be configured to validate against a single secret in shopify_python_api.
Solution
This needs to be handled similar to webhook validation, where it must be possible to specify the old API secret as well as the new one for signature validation, and accept the signature if it matches the ones generated with either secret.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No files or tests are named in the issue. Start by locating the existing OAuth2 signature validation entry point and compare its configuration and behavior with the webhook validation described in the linked credential-rotation documentation. Done means validation accepts signatures generated with either the current or old API secret while preserving current single-secret behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- api, authentication, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100