How to Correctly Verify Shopify Webhook Signatures in Node.js

·1 views

Shopify webhook verification commonly fails due to two developer mistakes: using hex encoding instead of base64, and allowing a JSON body parser to process the request before the raw bytes are hashed. Unlike Stripe and GitHub, Shopify base64-encodes its HMAC-SHA256 signature in the X-Shopify-Hmac-Sha256 header, keyed with the app's client secret. Developers must capture the raw request body using Express's raw() middleware on the webhook route itself, compute the HMAC over those untouched bytes, and compare the result in constant time using crypto.timingSafeEqual to prevent timing attacks. Parsing the JSON body before verification alters whitespace and key order, causing the signature check to fail even when the secret is correct. Shopify also expects a fast 200 response on success, so returning a 401 on HMAC mismatch and keeping the handler lightweight is recommended.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Neo4j Laravel Boost Lets AI Assistants Query Live Graph Databases via MCP

A new package called Neo4j Laravel Boost integrates the official Neo4j MCP server directly into Laravel Boost, enabling MCP-compatible AI coding assistants to access live Neo4j databases. The integration allows AI clients to inspect database schemas, execute Cypher queries, and access Graph Data Science procedures through a single existing Laravel Boost server. Developers can install the package via Composer, configure a Neo4j connection, and run an interactive setup wizard that handles validation and optional Docker deployment. One notable feature lets developers export their Laravel service container as a dependency graph into Neo4j, making application architecture queryable by AI tools. The package supports multiple transport options, including Bolt, subprocess, and remote connections, making it adaptable across local, Docker, and remote development environments.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AWS, Azure, and Google Are Building Identical AI Agent Stacks With Lock-In Risk

Amazon, Microsoft, and Google have each launched enterprise AI agent platforms in 2026 — AWS Bedrock AgentCore, Azure AI Foundry, and Google Vertex AI — that are architecturally near-identical, comprising a managed runtime, memory, identity, tooling, and observability layers. While the platforms integrate seamlessly with each cloud's existing storage and identity systems, making initial deployment fast, they create deep vendor dependency. Migrating an agent built on one platform to another requires a full rebuild rather than a simple configuration change, since identity bindings, networking, and state storage are all cloud-specific. Open standards like MCP help standardize how agents communicate with tools, but do not address portability of deployment infrastructure or stored state. Experts recommend keeping agent logic in vendor-neutral frameworks, abstracting model selection, and maintaining a cloud-agnostic control plane to avoid being locked into a single provider.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer builds 118-test browser tool that keeps all device data local

A developer frustrated with ad-heavy, privacy-questionable online device testers built TestOnDevice, a browser-based tool offering over 118 hardware diagnostics. The tool tests microphones, webcams, keyboards, gamepads, MIDI devices, and more using native Web APIs, with no server uploads, no account required, and no data leaving the user's machine. Modern browser APIs such as MediaDevices.getUserMedia, the Gamepad API, and Web MIDI API handle nearly every test entirely client-side. The project's core design rule — that no device data ever touches a server — guided all technical decisions, including aggressively releasing hardware access as soon as a test ends. The developer also noted browser privacy protections like blank device labels before permission is granted, which required UX workarounds such as displaying generic device names initially.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Self-hosted Umami analytics silently blocked if subdomain is named 'umami'

Developers self-hosting Umami analytics may unknowingly lose all visitor tracking data if their subdomain follows the common naming convention of 'umami.yourdomain.com'. The EasyPrivacy filter list, used by uBlock Origin, Brave, and AdGuard, contains a hostname-pattern rule that blocks any subdomain literally named 'umami' serving a 'script.js' file, regardless of whether the analytics are first-party or privacy-respecting. The failure is entirely silent — no errors appear in logs or the browser console, and affected visitors simply never register in the dashboard. One developer discovered the issue only after noticing a mismatch between Umami's reported traffic, server logs, and Stripe conversion data. The fix requires no changes to the Umami installation itself — simply serving the tracker script from a generic subdomain such as 'u.' or 'stats.' is enough to avoid the filter rule.

0 comments Read more at DEV Community