# shopify-express-easdk-session

> ![npm](https://img.shields.io/npm/v/shopify-express-easdk-session.svg?maxAge=259200) ![travis](https://travis-ci.org/marekweb/shopify-express-easdk-session.svg?branch=master) ![node](https://img.shields.io/badge/node-%3E=8.1-blue.svg)

Latest version **0.2.1** (published 2018-05-10) · MIT license · 0 weekly downloads

## Install

```sh
npm install shopify-express-easdk-session
pnpm add shopify-express-easdk-session
yarn add shopify-express-easdk-session
bun add shopify-express-easdk-session
```

## Health

**Score 15/100 (F)** — status: abandoned.

Positive: no vulnerabilities.

Warnings: low downloads; no types; no esm support; pre 1.0.

Negative: abandoned; low maintenance score.

## Facts

| | |
|---|---|
| Version | 0.2.1 |
| Published | 2018-05-10 |
| First published | 2017-03-17 |
| Weekly downloads | 0 |
| License | MIT |
| TypeScript types | none |
| Module format | CommonJS |
| Node | >=8.1.0 |
| Dependencies | 2 |
| Unpacked size | 8.8 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 1 |
| Author | Marek Zaluski |
| Maintainers | marekweb |

## Links

- npm: https://www.npmjs.com/package/shopify-express-easdk-session
- Repository: https://github.com/marekweb/shopify-express-easdk-session
- Homepage: https://github.com/marekweb/shopify-express-easdk-session#readme
- Issues: https://github.com/marekweb/shopify-express-easdk-session/issues
- npm.io page: https://npm.io/package/shopify-express-easdk-session

## Dependencies (2)

- [lodash.get](https://npm.io/package/lodash.get.md) ^4.4.2
- [shopify-verify-params](https://npm.io/package/shopify-verify-params.md) ^2.0.1

## Recent versions

- 0.2.1 (latest) — 2018-05-10
- 0.2.0 — 2018-02-01
- 0.1.0 — 2017-03-17

## README

# Shopify Express EASDK Session middleware

![npm](https://img.shields.io/npm/v/shopify-express-easdk-session.svg?maxAge=259200) ![travis](https://travis-ci.org/marekweb/shopify-express-easdk-session.svg?branch=master) ![node](https://img.shields.io/badge/node-%3E=8.1-blue.svg)

A small Express middleware for authenticating Shopify EASDK sessions. When a shop is authenticated, the shop's hostname is available at `req.authenticatedShopName`.

The module authenticates the user by reading the query string which is provided by the EASDK iframe and verifies its HMAC signature. The session is then stored in a signed cookie to make it available on subsequent requests. No database is necessary.

```js
const shopifyExpressEasdkSession = require('shopify-express-easdk-session');

app.use(shopifyExpressEasdkSession({shopifyClientSecret: 'your_client_secret'}));
```

The middleware will:

- detect a HMAC-signed set of query parameters from Shopify
- set a signed cookie to remember the session

This lets you access `req.authenticatedShopName` if a shop is authenticated. The value is a shop hostname, like `example.myshopify.com` if a shop is authenticated, otherwise it's null. A shop is authenticated if an HMAC-signed query string is present (the EASDK iframe sets this) or if a signed secure cookie is present. The cookie is set on a successful request authenticated by the query string.

## Usage

Attach the middleware to Express to check if a shop is authenticated.

You can protect a request handler from unauthenticated requests by checking for `req.authenticatedShopName` and redirecting if it's absent.

```js
app.use(shopifyExpressEasdkSession({shopifyClientSecret: 'your_client_secret'}));

app.get('/dashboard', (req, res, next) => {
  // If authenticatedShopName is null then no shop is authenticated
  if (!req.authenticatedShopName) {
    res.redirect('/');
    return
  }

  // Here, req.authenticatedShopName is the shop hostname
  res.send(`Hello, ${req.authenticatedShopName}`);
  // Hello, example.myshopify.com
});
```

## Requirements

- `cookie-parser` middleware (attached before this middleware) with a secret key. This is required because this middleware uses signed cookies. The secret key isn't related to the shopifyClientSecret option but you can use the same value.

---
_Source: https://npm.io/package/shopify-express-easdk-session · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._