Webhooks returning 401

[wlbrough]

Minimal implementation repo: https://github.com/wlbrough/mass-buy

Created a new rails app
Added shopify_app gem
Ran default generator
Ran webhook generator
Deployed to Heroku

Server logs: http://pastebin.com/wU6fsYJL

Adding 'config.action_dispatch.perform_deep_munge = false' to config/application.rb gets rid of the 'Value for ... set to nil' warnings, but doesn't seem to help the 401 issue.

[jamiemtdwyer]

Wlbrough,

Shopify_app will return 401 Unauthorized if the HTTP_X_SHOPIFY_HMAC_SHA256 does not match what is expected - this is a security feature. I would imagine that this is not a real webhook request being sent by Shopify considering that the id is 123456.

See this snippet for more information on the signing mechanism:

shopify_app/lib/shopify_app/webhook_verification.rb

Lines 17 to 29 in cb84776

	def verify_request
	data = request.raw_post
	return head :unauthorized unless hmac_valid?(data)
	end
	def hmac_valid?(data)
	secret = ShopifyApp.configuration.secret
	digest = OpenSSL::Digest.new('sha256')
	ActiveSupport::SecurityUtils.variable_size_secure_compare(
	shopify_hmac,
	Base64.encode64(OpenSSL::HMAC.digest(digest, secret, data)).strip
	)
	end

[jamiemtdwyer]

I see what's going on here -- this webhook was created via the admin and you're sending a test notification. shopify_app expects the HMAC-SHA256 header to be signed with the secret key of your application. If you create the webhook from the appropriate api client (the same that you're testing with), you won't run into this issue.

[wlbrough]

@jamiemtdwyer I triggered that request from the admin area of a test store by clicking the "send test notification" link. (Image: https://goo.gl/photos/QZQcKrGgGVdGWtCs7) I am also getting this result when I actually place an order in the test store.

[jamiemtdwyer]

You need to create the webhook via your app instead of the admin. shopify_app is expecting the webhook to be signed with the secret key for your application, but webhooks created via the admin are signed with a different key.

[wlbrough]

Ok I have it working now. Thank you for clarifying. I think what tripped me up was that the webhooks don't appear in the store admin when they're created through the app. It might help to clarify that in the docs.

[netwire88]

@jamiemtdwyer @wlbrough How do you test the API's if you can't use webhooks via Shopify Admin -> Notifications?