Hey everyone, I have been working on a custom Shopify integration that connects our digital catalog with an external utility portal, and I have run into a persistent roadblock with security headers and cross-origin navigation. Our storefront features an embedded proxy designed to pass authentication state over to our external application site, where customers can learn more about installation and technical setup. However, whenever the proxy initiates the handshake or when a customer transitions between the store and the external domain, the browser triggers Content Security Policy violations blocking the script resources. Alongside that, mobile webview users are experiencing intermittent session drops because the query parameters attached to the redirect get stripped out during the cross-origin transition. I have already tried updating the allowed origins in our app configuration and adjusting the frame-ancestors directive, but the preflight requests keep failing with 403 status codes in certain browsers. Has anyone encountered similar CSP or session persistence issues when linking a Shopify store with external companion platforms, and what is the recommended way to handle these cross-origin transitions cleanly without violating Shopify’s security requirements?
Hey @Necox_Yiy - thanks for reaching out.
Could you share the x-request-id response header from one of the failing 403 requests? This should help us locate the request in our logs and narrow down the issue for you.
Could you also clarify what you mean by “embedded proxy”: a Shopify app proxy, a custom proxy, or an iframe? Does the 403 occur during the authentication handshake, during the redirect to the external domain, or both?