How to authenticate request with session tokens manually?

Authentication & Access
2

Hey Remy!

Session token is not an HMAC but a JWT. You would need to decode the JWT.

We use python (Django) to decode it but I took some help from AI and got this code for ROR.

def verify_session_token
  session_token = request.headers['Authorization']
  
  begin
    payload = JWT.decode(
      session_token,
      Rails.configuration.shopify_api_secret,
      true,
      {
        algorithms: ['HS256'],
        aud: Rails.configuration.shopify_api_key,
        leeway: 10
      }
    ).first
    
    shop = URI.parse(payload['dest']).host
  rescue JWT::DecodeError => e
    puts "Invalid Token"
  end
end

Let me know if this helps.

1 Like