My Shopify embedded app makes two separate document requests to the same route (/app) when opened from the Shopify Admin, with timestamps 6-7 seconds apart. Both requests:
-
Have embedded=1 in the URL
-
Have valid, but different id_token values
-
Have different hmac and timestamp values
-
Return HTTP 200 (successful page load)
-
Are initiated by Shopify Admin (not my app code)
Example Network Requests:
1st: /app?embedded=1&…×tamp=1763321204
2nd: /app?embedded=1&…×tamp=1763321211 (7 seconds later)
Both requests hit my Remix loader, run authentication, database queries, and return the same HTML. This doubles my initial load time and impacts LCP (Largest Contentful Paint).
What i have tested:
Not caused by auth strategy - Tested both unstable_newEmbeddedAuthStrategy: false and true
Not caused by my redirect logic - No redirects in my code trigger this
Server logs confirm - Two separate loader executions with different timestamps