--- title: About app security description: >- Learn about the security requirements that your app needs to meet before you submit it for review by Shopify. source_url: html: 'https://shopify.dev/docs/apps/build/security' md: 'https://shopify.dev/docs/apps/build/security.md' --- # About app security Shopify reviews every app's security before publishing it in the Shopify App Store. This guide describes the five requirements that the review checks: protection against common web vulnerabilities, encryption in transit, closed network service ports, secure token generation, and careful handling of shortened URLs. A related requirement, [iframe protection](https://shopify.dev/docs/apps/build/security/set-up-iframe-protection), has its own setup guide. *** ## Protect against common vulnerabilities Shopify expects that all third-party applications be protected against common web security vulnerabilities, including but not limited to, [The OWASP Top 10](https://owasp.org/www-project-top-ten/). The OWASP Top 10 is a list of the most critical security risks to web applications and is published by the Open Web Application Security Project (OWASP). The list is a standard awareness document for developers and web application security experts. If we discover any vulnerabilities in your app during the application review, then your app will be rejected and you'll be required to fix the vulnerabilities before submitting your app for another review. [The OWASP Top Ten](https://owasp.org/www-project-top-ten/) list includes all the necessary information to understand common web application vulnerabilities and how to protect against them. The list also includes OWASP cheat sheets and external references. Another resource you can use is the [Web Security Academy](https://portswigger.net/web-security), a free online training center for web application security. The Web Security Academy includes interactive labs where you can put what you learn to the test. *** ## Encrypt with TLS All data exchanged between a client (such as a merchant's web browser) and your app server should be encrypted using Transport Layer Security (TLS) to ensure that any data transmitted can only be read by your application server. TLS certificates are used to protect the end users’ information while it's transmitting and to authenticate the website’s organization identity. Websites secured by a TLS certificate will display HTTPS and the small padlock icon in the browser address bar. If we can't validate your TLS certificate when we review your app, then your app will be rejected. You'll be required to fix your certificate configuration before submitting your app for another review. If you don't have a valid TLS certificate already, then you can obtain one free of charge from [Let’s Encrypt](https://letsencrypt.org/), a free, automated, and open certificate authority. However, a TLS certificate issued by any trusted Certificate Authority is acceptable. You can't use a self-signed certificate. After you've created your TLS certificate, you can ensure that it's correctly installed by visiting [SSL Checker](https://www.sslshopper.com/ssl-checker.html) and entering your app's hostname. *** ## Secure your network service ports To help ensure the security of your app, you must not expose any services publicly that aren't necessary for the functionality of your app. Common services that shouldn't be exposed include MySQL, Redis, Memcached, and Elasticsearch. During the app review process, we identify publicly accessible services by using the security tool Nmap to identify [open ports](https://en.wikipedia.org/wiki/Port_\(computer_networking\)). If our scan detects unexpected open ports when we review your app, then you'll be notified and asked to re-evaluate whether the services need to be publicly accessible. If the services do need to be publicly accessible, then you'll be given a Google form, where you must explain the following: * what services are running on the detected open ports * why each service is necessary to the proper functioning of your application * why the service must be publicly accessible * what steps you have taken to ensure that having the service publicly accessible is safe for Shopify merchants and buyers If you're unsure how to modify a service or your host configuration to make services inaccessible publicly, the following links explain the solution for common hosting providers: * [Amazon Web Services](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html) * [Google Cloud Platform](https://cloud.google.com/vpc/docs/firewalls) * [Microsoft Azure](https://docs.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview) * [Digital Ocean](https://docs.digitalocean.com/products/networking/firewalls/) *** ## Generate secure tokens If your app relies on tokens to authenticate users, then you must ensure the token is randomly generated with 128 bits of [entropy](https://en.wikipedia.org/wiki/Entropy) to ensure the security of Shopify merchant data. In some cases, we allow 64 bits where token length is a concern. If the token will be publicly accessible (for example, included as a parameter in a URL), then you must ensure that the token has an expiration date of no longer than seven days, and you must prevent the token from being leaked to, or indexed, by third parties. If we detect the use of tokens in your app without sufficient entropy, or tokens that don't expire or can be leaked or indexed by third parties, then your app will be rejected. You'll be required to fix the identified problem before submitting your app for another review. The following links can be used to generate secure random tokens for several popular programming languages: * [Python](https://docs.python.org/3/library/secrets.html) * [Ruby](https://ruby-doc.org/stdlib-2.5.1/libdoc/securerandom/rdoc/SecureRandom.html) * [PHP](https://www.php.net/manual/en/function.random-bytes.php) * [JavaScript](https://developer.mozilla.org/en-US/docs/Web/API/Crypto/getRandomValues) * [Go](https://pkg.go.dev/crypto/rand) * [Java](https://docs.oracle.com/javase/8/docs/api/java/security/SecureRandom.html) When a token is used to authenticate access to private information, you must ensure that the private information can't be indexed by search engines. Google's guide [Block Search indexing with 'noindex'](https://developers.google.com/search/docs/advanced/crawling/block-indexing) explains how to properly configure a HTML meta tag to prevent search indexing. Additionally, any app URL which accepts a token must ensure it includes a [Referrer-Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy) header in the HTTP response with a value of *origin-when-cross-origin* or, preferably, *no-referrer*. *** ## Shorten URLs with care URL shortening is a technique in which a long URL is shortened, usually by creating a shorter URL that will redirect to the long URL. This technique is commonly used to make a link more visually appealing or to hide the address. However, URL shortening is vulnerable to brute-force attacks. This means that attackers can programmatically enumerate on the set of possible shortened URLs, and access any valid URLs from the set. To ensure the security of Shopify merchant data, you should use high-entropy, non-guessable URLs at all times whether handling confidential or non-confidential data. If your app generates URLs that might hold confidential information, then you shouldn't use techniques to shorten the URL. This applies to any URLs that could pose a risk if compromised, including but not limited to: * Checkout URLs * Order URLs * Other URLs that might include secret tokens or PII ***