---
title: Configured callback URL is not HTTPS
description: >-
  Detects webhook subscriptions and OAuth redirect URLs configured with unsafe
  absolute URLs.
source_url:
  html: >-
    https://shopify.dev/docs/apps/build/security/app-security-checks/insecure-webhook-url
  md: >-
    https://shopify.dev/docs/apps/build/security/app-security-checks/insecure-webhook-url.md
---

# Configured callback URL is not HTTPS

Detects webhook subscriptions and OAuth redirect URLs configured with unsafe absolute URLs.

| Detail | Value |
| - | - |
| Check ID | `INSECURE_WEBHOOK_URL` |
| Severity | High |
| How it runs | Deterministic scan and agent review |

***

## Vulnerable example

## shopify.app.toml

```toml
[[webhooks.subscriptions]]
topics = [ "orders/create" ]
# Plaintext HTTP: the payload and its HMAC header cross the
# network in the clear, and anyone on the path can read or alter
# them.
uri = "http://hooks.example-app.com/webhooks/orders/create"


[auth]
redirect_urls = [ "http://example-app.com/auth/callback" ]
```

***

## How to fix

Use HTTPS for every OAuth redirect URL. For webhook subscription URIs, use HTTPS or a relative path that starts with a slash.

For more detail, see [Webhooks](https://shopify.dev/docs/apps/webhooks).

## shopify.app.toml

```toml
[[webhooks.subscriptions]]
topics = [ "orders/create" ]
# HTTPS, or a Shopify-relative path such as
# "/webhooks/orders/create". The other supported destinations are
# Pub/Sub, "pubsub://{project-id}:{topic-id}", and Amazon
# EventBridge, which takes a partner event-source ARN.
uri = "https://hooks.example-app.com/webhooks/orders/create"


[auth]
redirect_urls = [ "https://example-app.com/auth/callback" ]
```

***

## Related

* [`shopify app security check`](https://shopify.dev/docs/api/shopify-cli/app/app-security-check), the command that runs this check
* [All app security checks](https://shopify.dev/docs/apps/build/security/app-security-checks)

***