Simplified OAuth process for addons integration in admin

The best way to provide addons settings to the eshop admins is to integrate them into Shoptet administration. The settings page is integrated as an iframe. To avoid unathorized access to the settings page, an OAuth authentication is necessary. Formerly it was necessary to redirect to Shoptet OAuth server and perform challenge code verification. Now we provide the challenge code directly within iframe source url, which is faster and avoids using cookies, which are dropped by some more restrictive browsers for cross-site requests, such as Safari.

Additionally there are now two ways of iframe integration:

• The already existing, where iframe source url is directly calling your web server. In this case the request is cross-site and you cannot rely your cookies will be transferred, so you have to use JWT, Paseto or similar.
• Proxy pass solution, where the iframe URL is translated to an eshop domain and the URL is expanded on our web servers. Our webservers call your server and pass the output as an eshop page. In this case cookies are transferred, because all requests are on the same site from the browser point of view. There are however some limitations on URL format and CORS cannot be easily used.

For more details see Placing the addon settings into Shoptet administration and Eshop verification usingg OAuth. If you have the addons settings already implemented, we have prepared a guide to change – consider to change your software as soon as possible to avoid problems of your Safari users.

Post navigation