shopify-api-js icon indicating copy to clipboard operation
shopify-api-js copied to clipboard

[Feature] Add support for http2

Open maxfrigge opened this issue 3 years ago • 1 comments

The cookie related methods were not compatible with http2.

WHY are these changes introduced?

The current version does not support the http2 types of the request/response Node objects. This makes it impossible to use the package in a http2 server written in Typescript, unless you are OK with ignoring the type errors.

WHAT is this pull request doing?

Replace the cookies package (which also writes the response header) with the cookie package (which just parses cookie strings). This requires to manually set and read the cookie header, but gives greater control and allows to also work with the http2 request/response interfaces.

One thing to note is that the new cookie package won't sign cookies. My understanding is that this is not necessary when using secure and httponly cookies, but should be confirmed be a security expert. This change could potentially break existing cookies, but should "just" cause a new login flow, which then updates to an unsigned cookie.

I have added @ts-ignore comments to ignore unused variable errors for the arguments of getCookieSessionId and setCookieSessionId in order to not introduce a breaking change in the api surface.

Type of change

  • [ ] Patch: Bug (non-breaking change which fixes an issue)
  • [x] Minor: New feature (non-breaking change which adds functionality)
  • [ ] Major: Breaking change (fix or feature that would cause existing functionality to not work as expected)

Checklist

  • [ ] I have added a changelog entry, prefixed by the type of change noted above
  • [x] I have added/updated tests for this change
  • [ ] I have documented new APIs/updated the documentation for modified APIs (for public APIs)

maxfrigge avatar Apr 16 '22 08:04 maxfrigge

@paulomarg I have created this new PR after #232 was closed.

maxfrigge avatar Apr 16 '22 08:04 maxfrigge

Hey, sorry for the delay in responding. In the end, we're not even using http directly any more so this doesn't really apply. Thank you for your patience and for contributing to our repo!

paulomarg avatar Dec 05 '23 16:12 paulomarg