Create concern to authenticate deep links using Turbolinks #1118

NabeelAhsen · 2020-12-07T19:29:19Z

Related #1092

This is related to supporting session tokens using Turbolinks. This PR introduces an optional controller concern that helps authenticate multi-page apps when accessing a link directly.

Currently, with third party cookies disabled, a user is unable to access protected endpoints like /products or /widgets. When using Turbolinks, the recommended way of issuing a valid session token via App Bridge is by creating a splash page as the root resource of the app.

More info: https://shopify.dev/tutorials/authenticate-server-side-rendered-apps-with-session-tokens-app-bridge-turbolinks

This concern redirects an app to the root controller along with a return_to and shop parameter if it detects that an action is unauthenticated (i.e it fails to detect a valid session token session). Once a session token has been issued by App Bridge, Turbolinks can use this to redirect the app back to the return_to parameter in shopify_app.js:

  // Wait for a session token before trying to load an authenticated page
  await retrieveToken(app);

  // Redirect to the requested page
  Turbolinks.visit(data.loadPath);

To use this concern, add it to the sample AuthenticatedController that gets generated by the Shopify App gem:

# frozen_string_literal: true

class AuthenticatedController < ApplicationController
  include ShopifyApp::TurbolinksAuthenticated # <= Add this here
  include ShopifyApp::Authenticated
end

Show this works using app extensions and direct app-links
Update CHANGELOG.md if the changes would impact users
Update README.md, if appropriate.
Update any relevant pages in docs/, if necessary
For security fixes, the Disclosure Policy must be followed.

NabeelAhsen · 2020-12-07T19:29:57Z

app/controllers/concerns/shopify_app/turbolinks_authenticated.rb

+# frozen_string_literal: true
+
+module ShopifyApp
+  module TurbolinksAuthenticated


I'm not entirely sure what to call this concern yet, I'm open to suggestions!

thecodepixi · 2020-12-07T19:56:28Z

Hey @NabeelAhsen, this looks awesome, but it looks like there are 2 small linter errors at the moment.

NabeelAhsen · 2020-12-07T19:58:12Z

Hey @NabeelAhsen, this looks awesome, but it looks like there are 2 small linter errors at the moment.

Oh yeah I've been trying to run bundle exec rubocop locally to fix these, but to no avail! It seems that there's a mismatch in the rubocop versions in the CI vs my local environment 😬

Do you have any recommendations around this?

Edit: Oh it seems that this will most likely be fixed by https://github.com/Shopify/shopify_app/tree/melaniew/fix_rubocop_error

mllemango · 2020-12-07T20:16:06Z

Sorry that's on me 😅, PR's' up!

thecodepixi · 2020-12-07T20:17:31Z

I just noticed the same. It looks like that rubocop error exists on master, so you might want to rebase on master when that fix is merged.

As for why rubocop isn't working for you locally, it looks like the CI just runs the latest version of the gems (rubocop and rubocop-shopify) so you may just need to update them locally as well.

thecodepixi · 2020-12-07T20:18:57Z

Sorry that's on me 😅, PR's' up!

Approved ✅

thecodepixi · 2020-12-07T20:23:24Z

@NabeelAhsen You should be good to rebase master to get rid of that rubocop error 👍

andyw8 · 2020-12-07T20:32:31Z

I opened #1120 which should help to avoid some types of RuboCop version mismatch.

ragalie

Makes sense to me!

NabeelAhsen · 2020-12-08T19:52:56Z

I've added a section in README.md to explain this concern a little better. I'm still having a hard time naming this thing -- does EnsureAuthenticatedLinks sound too confusing?

paulomarg

I'm not very good at naming things, but I kind of like what we have. The README text LGTM.

andyw8 · 2020-12-09T15:17:21Z

README.md

+
+The `ShopifyApp::EnsureAuthenticatedLinks` concern helps authenticate users that access protected pages of your app directly.
+
+Include this concern in your app's `AuthenticatedController` if your app uses session tokens with [Turbolinks](https://shopify.dev/tutorials/authenticate-server-side-rendered-apps-with-session-tokens-app-bridge-turbolinks). It adds a `before_action` filter that detects whether a session token is present or not. If a session is not found, the app is redirected to your app's splash page path (`root_path`) along with `return_to` and `shop` parameters.


"the app is redirected" - should that say "the user is redirected" ?

Good catch!

andyw8 · 2020-12-09T15:18:03Z

README.md

+Example `AuthenticatedController`:
+
+```rb
+# frozen_string_literal: true


I don't think we need to include the frozen_string_literal line in the example.

rezaansyed

LGTM 👍

greatestape

This is great! Nicely done.

netwire88 · 2021-01-22T11:59:38Z

Hi @NabeelAhsen, I noticed that the order of the concerns matter.

This doesn't work. If you go to a deep link in an incognito browser window (or any browser window not logged into Shopify), you get an ShopifyDomainNotFound error.

class AuthenticatedController < ApplicationController
  include ShopifyApp::EnsureAuthenticatedLinks
  include ShopifyApp::Authenticated
end

However, if I change it to this, it works. It'll ask for myshopify URL first and then login in + redirect.

class AuthenticatedController < ApplicationController
  include ShopifyApp::Authenticated
  include ShopifyApp::EnsureAuthenticatedLinks
end

Can you confirm?

NabeelAhsen · 2021-01-22T15:30:03Z

Hi @NabeelAhsen, I noticed that the order of the concerns matter.

This doesn't work. If you go to a deep link in an incognito browser window (or any browser window not logged into Shopify), you get an ShopifyDomainNotFound error.
class AuthenticatedController < ApplicationController
  include ShopifyApp::EnsureAuthenticatedLinks
  include ShopifyApp::Authenticated
end
However, if I change it to this, it works. It'll ask for myshopify URL first and then login in + redirect.
class AuthenticatedController < ApplicationController
  include ShopifyApp::Authenticated
  include ShopifyApp::EnsureAuthenticatedLinks
end
Can you confirm?

@netwire88 Thank you for bringing this to our attention! This is definitely an oversight, and is being fixed with this PR: #1158

The PR i linked here will allow the order of EnsureAuthenticatedLinks and Authenticated to stay the same.

netwire88 · 2021-01-22T22:12:28Z

Thanks @NabeelAhsen !

NabeelAhsen requested a review from a team as a code owner December 7, 2020 19:29

NabeelAhsen self-assigned this Dec 7, 2020

NabeelAhsen commented Dec 7, 2020

View reviewed changes

NabeelAhsen force-pushed the add-deep-linking-auth-support branch from f2e9e5a to a50f7df Compare December 7, 2020 20:46

ragalie approved these changes Dec 7, 2020

View reviewed changes

mSitkovets approved these changes Dec 8, 2020

View reviewed changes

NabeelAhsen force-pushed the add-deep-linking-auth-support branch from a50f7df to 9336b4a Compare December 8, 2020 15:01

Create concern to authenticate deep links using Turbolinks

cab35c4

NabeelAhsen force-pushed the add-deep-linking-auth-support branch from 9336b4a to cab35c4 Compare December 8, 2020 15:02

paulomarg approved these changes Dec 8, 2020

View reviewed changes

NabeelAhsen requested review from theundeadmonk, paulomarg, ragalie and mSitkovets December 8, 2020 19:51

NabeelAhsen requested a review from greatestape December 9, 2020 03:21

paulomarg approved these changes Dec 9, 2020

View reviewed changes

andyw8 reviewed Dec 9, 2020

View reviewed changes

Update README.md

a6c11fc

NabeelAhsen force-pushed the add-deep-linking-auth-support branch from b0698c3 to a6c11fc Compare December 9, 2020 15:35

rezaansyed approved these changes Dec 9, 2020

View reviewed changes

greatestape approved these changes Dec 10, 2020

View reviewed changes

mSitkovets approved these changes Dec 14, 2020

View reviewed changes

Merge branch 'master' into add-deep-linking-auth-support

b8ed5c9

NabeelAhsen merged commit 6dccdb4 into master Dec 14, 2020

NabeelAhsen deleted the add-deep-linking-auth-support branch December 14, 2020 19:30

NabeelAhsen mentioned this pull request Dec 14, 2020

Packaging for release 16.1.0 #1123

Merged

4 tasks

NabeelAhsen temporarily deployed to rubygems December 15, 2020 14:57 Inactive

NabeelAhsen mentioned this pull request Jan 22, 2021

[Bug fix] Redirect EnsureAuthenticatedLinks to login page if shop domain not found #1158

Merged

4 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Create concern to authenticate deep links using Turbolinks #1118

Create concern to authenticate deep links using Turbolinks #1118

NabeelAhsen commented Dec 7, 2020 •

edited

Loading

NabeelAhsen Dec 7, 2020

thecodepixi commented Dec 7, 2020

NabeelAhsen commented Dec 7, 2020 •

edited

Loading

mllemango commented Dec 7, 2020

thecodepixi commented Dec 7, 2020

thecodepixi commented Dec 7, 2020

thecodepixi commented Dec 7, 2020

andyw8 commented Dec 7, 2020

ragalie left a comment

NabeelAhsen commented Dec 8, 2020

paulomarg left a comment

andyw8 Dec 9, 2020

NabeelAhsen Dec 9, 2020

andyw8 Dec 9, 2020 •

edited

Loading

rezaansyed left a comment

greatestape left a comment

netwire88 commented Jan 22, 2021

NabeelAhsen commented Jan 22, 2021

netwire88 commented Jan 22, 2021


		The `ShopifyApp::EnsureAuthenticatedLinks` concern helps authenticate users that access protected pages of your app directly.

		Include this concern in your app's `AuthenticatedController` if your app uses session tokens with [Turbolinks](https://shopify.dev/tutorials/authenticate-server-side-rendered-apps-with-session-tokens-app-bridge-turbolinks). It adds a `before_action` filter that detects whether a session token is present or not. If a session is not found, the app is redirected to your app's splash page path (`root_path`) along with `return_to` and `shop` parameters.

Create concern to authenticate deep links using Turbolinks #1118

Create concern to authenticate deep links using Turbolinks #1118

Conversation

NabeelAhsen commented Dec 7, 2020 • edited Loading

NabeelAhsen Dec 7, 2020

Choose a reason for hiding this comment

thecodepixi commented Dec 7, 2020

NabeelAhsen commented Dec 7, 2020 • edited Loading

mllemango commented Dec 7, 2020

thecodepixi commented Dec 7, 2020

thecodepixi commented Dec 7, 2020

thecodepixi commented Dec 7, 2020

andyw8 commented Dec 7, 2020

ragalie left a comment

Choose a reason for hiding this comment

NabeelAhsen commented Dec 8, 2020

paulomarg left a comment

Choose a reason for hiding this comment

andyw8 Dec 9, 2020

Choose a reason for hiding this comment

NabeelAhsen Dec 9, 2020

Choose a reason for hiding this comment

andyw8 Dec 9, 2020 • edited Loading

Choose a reason for hiding this comment

rezaansyed left a comment

Choose a reason for hiding this comment

greatestape left a comment

Choose a reason for hiding this comment

netwire88 commented Jan 22, 2021

NabeelAhsen commented Jan 22, 2021

netwire88 commented Jan 22, 2021

NabeelAhsen commented Dec 7, 2020 •

edited

Loading

NabeelAhsen commented Dec 7, 2020 •

edited

Loading

andyw8 Dec 9, 2020 •

edited

Loading