Requests constantly missing JWT

App Bridge
45

Hi @Alan_G, yes can you DM me?

Just got another expired JWT today, that’s expired on April 15! I’ll share this one with you.

46

No worries - sending you a DM :slight_smile:

47

Hey @flavio-b - we’ve pushed some fixes that might help with this. Can you let me know if you’re still seeing any expired JWTs?

48

Hi @Alan_G,

A few days after our DMs on this topic, probably after May 5th or so, the null or undefined tokens coming from fetch requests disappeared. It was nothing we did. That problem simply stopped.

But we’re still getting several expired tokens daily. Sometimes the token has been expired for only a few minutes, and sometimes a few days. We haven’t seen any very expired tokens (by several weeks) since after our last conversation. So things have improved, but not the point we can remove our workaround/middleware to handle these.

Did the team just release a fix for this today? I can keep watching.

49

Hey @flavio-b - interesting! Thanks for sharing that. My understanding is that we pushed the fix around the end of last month (I’ve been out of the office intermittently so was just able to catch up on updates now for this).

If you do see any more examples let me know and I can get in touch with folks internally on my end for you for sure.

50

Thanks, Alan! Yes, whatever the fix was for the null and undefined tokens, it worked. But we still get the expired tokens frequently, coming from URL params or from fetch (AppBridge).

The latest was from just about an hour ago:

  1. Submitted via URL param (from Shopify) at 12:06pm
  2. Was expired at 12:04pm.

This is not bad, but some have been expired for a few days.

51

Hey @flavio-b - thanks for confirming. That lines up with what I’m seeing too: the null / undefined token issue should be addressed now, but the expired-token cases are a separate thing.

I’ll set up a new DM here with you on this. Could you DM me a couple of fresh examples when you see them? The most useful details would be the shop, exact UTC timestamp, whether the token came from the URL param or an App Bridge fetch Authorization header, and the decoded iat / nbf / exp values. If it was a fetch request, it would also help to know whether your backend returned 401 with X-Shopify-Retry-Invalid-Session-Request: 1.

I’ll take those back internally as a separate follow-up from the null / undefined fix.