Configured callback URL is not HTTPS
Detects webhook subscriptions and OAuth redirect URLs configured with unsafe absolute URLs.
| Detail | Value |
|---|---|
| Check ID | INSECURE_WEBHOOK_URL |
| Severity | High |
| How it runs | Deterministic scan and agent review |
Anchor to Vulnerable exampleVulnerable example
shopify.app.toml
[[webhooks.subscriptions]]
topics = [ "orders/create" ]
# Plaintext HTTP: the payload and its HMAC header cross the
# network in the clear, and anyone on the path can read or alter
# them.
uri = "http://hooks.example-app.com/webhooks/orders/create"
[auth]
redirect_urls = [ "http://example-app.com/auth/callback" ]
Anchor to How to fixHow to fix
Use HTTPS for every OAuth redirect URL. For webhook subscription URIs, use HTTPS or a relative path that starts with a slash.
For more detail, see Webhooks.
shopify.app.toml
[[webhooks.subscriptions]]
topics = [ "orders/create" ]
# HTTPS, or a Shopify-relative path such as
# "/webhooks/orders/create". The other supported destinations are
# Pub/Sub, "pubsub://{project-id}:{topic-id}", and Amazon
# EventBridge, which takes a partner event-source ARN.
uri = "https://hooks.example-app.com/webhooks/orders/create"
[auth]
redirect_urls = [ "https://example-app.com/auth/callback" ]
shopify app security check, the command that runs this check- All app security checks
Was this page helpful?