Packages
shopifex
2.1.12
2.4.0
2.3.0
2.2.2
2.2.1
2.2.0
2.1.20
2.1.19
2.1.18
2.1.17
2.1.16
2.1.15
2.1.14
2.1.13
2.1.12
2.1.11
2.1.10
2.1.9
2.1.8
2.1.7
2.1.6
2.1.5
2.1.4
2.1.3
2.1.2
2.1.1
2.1.0
2.0.1
2.0.0
1.1.1
1.1.0
1.0.1
1.0.0
0.6.2
0.6.1
0.6.0
0.5.7
0.5.6
0.5.5
0.5.4
0.5.3
0.5.2
0.5.1
0.5.0
0.4.1
0.4.0
0.3.6
0.3.5
0.3.4
0.3.3
0.3.2
0.3.1
0.3.0
0.2.1
0.2.0
0.1.5
0.1.4
0.1.3
0.1.2
0.1.1
0.1.0
Phoenix boilerplate for Shopify Embedded App SDK
Current section
Files
Jump to
Current section
Files
lib/shopifex/plug/set_csp_header.ex
defmodule Shopifex.Plug.SetCSPHeader do
@moduledoc """
Adds Content-Security-Policy response header to the provided `Plug.Conn` in order to securely
load embedded application in the Shopify admin panel.
Read more here: https://shopify.dev/apps/store/security/iframe-protection#embedded-apps
"""
defexception message: "an error occurred when attempting to set CSP headers"
@shopify_unified_admin_url "https://admin.shopify.com"
@spec init(options :: Plug.opts()) :: Plug.opts()
def init(options) do
# initialize options
options
end
@spec call(conn :: Plug.Conn.t(), opts :: Plug.opts()) :: Plug.Conn.t() | none()
def call(conn, _) do
case get_current_shop(conn) do
{:ok, shop} ->
url = Shopifex.Shops.get_url(shop)
allowed_frame_ancestors = [@shopify_unified_admin_url, "https://#{url}"]
Plug.Conn.put_resp_header(
conn,
"content-security-policy",
"frame-ancestors #{Enum.join(allowed_frame_ancestors, " ")};"
)
{:error, :no_current_shop} ->
raise(__MODULE__,
message:
"Cannot set CSP header without shop loaded in session. Ensure that this plug is being called on a `conn` which has been passed through the `Shopifex.Plug.ShopifySession` plug."
)
end
end
defp get_current_shop(conn) do
case Shopifex.Plug.current_shop(conn) do
nil -> {:error, :no_current_shop}
shop -> {:ok, shop}
end
end
end