From 4791cef4d74ad46fb095a0550b298653dce4e265 Mon Sep 17 00:00:00 2001 From: Muhsin Date: Tue, 17 Feb 2026 18:58:11 +0530 Subject: [PATCH] Update callbacks_controller.rb --- app/controllers/shopify/callbacks_controller.rb | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/app/controllers/shopify/callbacks_controller.rb b/app/controllers/shopify/callbacks_controller.rb index 63b32e71a..a4484d270 100644 --- a/app/controllers/shopify/callbacks_controller.rb +++ b/app/controllers/shopify/callbacks_controller.rb @@ -117,7 +117,9 @@ class Shopify::CallbacksController < ApplicationController # Shopify signs callback parameters with HMAC to prevent tampering hmac = params[:hmac] - query_params = params.except(:hmac, :controller, :action).to_query + # Convert to unsafe hash to avoid strong parameters restriction, then build query string + # Shopify expects parameters to be sorted alphabetically when computing HMAC + query_params = params.except(:hmac, :controller, :action).to_unsafe_h.sort.to_h.to_query computed_hmac = OpenSSL::HMAC.hexdigest(OpenSSL::Digest.new('SHA256'), client_secret, query_params) ActiveSupport::SecurityUtils.secure_compare(computed_hmac, hmac)