issue 'Unable to verify signature.' where the HMAC signature sent by Shopify during authentication suddenly does not match

techbin commented 5 months ago

For bug reporting only! If you're posting a feature request or discussion, please ignore.

I'm relatively new to app development and currently working on creating a Shopify app using Laravel 11. I've encountered an issue 'Unable to verify signature.' where the HMAC signature sent by Shopify during authentication suddenly does not match.

Despite attempting various troubleshooting steps such as clearing browser cache, installing on new stores, and verifying API and secret keys, I'm still facing this issue.

Expected Behavior

Verify the signature & add the stores in the db and show the dashboard and allow billing

Current Behavior

The system was working fine (Laravel 8.75 and laravel-shopify:17.4.3) and I was getting 'Unable to verify signature.' for only the "old stores" which was fine for me but after adding billing (enabled shopify payments and test gateways) - further made some transactions that failed. All the links in the app started having an issue. Unsure if this is an issue with Shopify or something else.

Steps to Reproduce

Initially the system was Laravel 8.75 and "kyon147/laravel-shopify": "17.4.3" after started getting "Unable to verify signature." I upgraded my system to below configuration but the issue still exists.

Please provide detailed steps for reproducing the issue.

Install Laravel: 11
Install laravel-shopify: 21.0
Follow installation steps and access any route link

Context

Please provide any relevant information about your setup. This is important in case the issue is not reproducible except for under certain conditions.

PHP Version: 8.2.16
Laravel Version: 11.2.0
Laravel Shopify: 21.0
Template Engine: Blade

Failure Logs

Please include any relevant log snippets or files here. ` //Unable to verify signature. Osiset \ ShopifyApp \ Http \ Middleware \ VerifyShopify : 96 handle // Verify the HMAC (if available)

    $hmacResult = $this->verifyHmac($request);

    if ($hmacResult === false) {

        // Invalid HMAC

        throw new SignatureVerificationException('Unable to verify signature.'); **** Error ****

    }

`

Screenshot from 2024-04-09 10-12-38