---
title: App proxy Liquid injection risk
description: >-
  Detects app proxy endpoints that interpolate request parameters into active
  Liquid or HTML responses.
source_url:
  html: >-
    https://shopify.dev/docs/apps/build/security/app-security-checks/app-proxy-liquid-injection
  md: >-
    https://shopify.dev/docs/apps/build/security/app-security-checks/app-proxy-liquid-injection.md
---

# App proxy Liquid injection risk

Detects app proxy endpoints that interpolate request parameters into active Liquid or HTML responses.

| Detail | Value |
| - | - |
| Check ID | `APP_PROXY_LIQUID_INJECTION` |
| Severity | High |
| How it runs | Deterministic scan and agent review |

***

## Vulnerable example

## app/routes/proxy.welcome.tsx

```tsx
import type { LoaderFunctionArgs } from "react-router";


export const loader = async ({ request }: LoaderFunctionArgs) => {
  const shop = new URL(request.url).searchParams.get("shop");


  // Request input interpolated into a Liquid response. The
  // storefront renders the body as Liquid, so injected tags
  // such as {{ customer.email }} run too.
  return new Response(`<div>Welcome, ${shop}</div>`, {
    headers: { "Content-Type": "application/liquid" },
  });
};
```

***

## How to fix

Don't interpolate user input into `application/liquid` responses. Use `application/json` or escape all input.

For more detail, see [App proxies](https://shopify.dev/docs/apps/online-store/app-proxies).

## app/routes/proxy.welcome.tsx

```tsx
import type { LoaderFunctionArgs } from "react-router";


import { authenticate } from "../shopify.server";


export const loader = async ({ request }: LoaderFunctionArgs) => {
  // The verified session carries the shop, and JSON is not an
  // active content type, so nothing in the body is evaluated.
  const { session } = await authenticate.public.appProxy(request);


  return new Response(JSON.stringify({ shop: session?.shop }), {
    headers: { "Content-Type": "application/json" },
  });
};
```

***

## Related

* [`shopify app security check`](https://shopify.dev/docs/api/shopify-cli/app/app-security-check), the command that runs this check
* [All app security checks](https://shopify.dev/docs/apps/build/security/app-security-checks)

***