Webhooks sending still signed with old revoked client secret

Webhooks and Events
1

I’m noticing an issue with webhooks after rotating app credentials.

Here are the docs for rotating and revoking client credentials: https://shopify.dev/docs/apps/build/authentication-authorization/client-secrets/rotate-revoke-client-credentials

It states that “Shopify will sign webhooks with your app’s oldest unrevoked client secret.” However, in my testing, I’ve found that after revoking the old secret, Shopify will still send webhooks signed with the old secret for up to about 30 minutes after it was revoked.

I’ve generated a new client secret and my app uses both (at this point webhooks are still signed with the old one. Expected behavior) > After rotating all my store’s access tokens, I remove references to the old one and revoke it > Try sending a webhook, and it fails with the new secret. I verify the hmac locally with the old secret, and it succeeds.

It will continue to use the old secret for about 30 minutes or so, then start using the new secret. But I feel like that window is a security issue. I don’t want to be verifying webhooks with a revoked secret.

2

Hey @jc_lk - thanks for flagging this. The ~30-minute window is within the expected behaviour, as webhook HMACs can take up to an hour to switch to the new secret: Verify webhook deliveries

For routine rotations, you’ll need to validate against both secrets during that transition. I definitely get the security concern though, and the rotation guide could be clearer about this delay, so I’ll pass that feedback along on our end.

If the old secret is still being used after an hour, let us know with the timestamps and webhook ID and we can dig into it further. Hope this helps!