Incompatibility with .Net Core 3.1.3, System.Text.JSON and Newtonsoft.JSON

[sebastienlabine]

Problem

While attemping to handle a shopify uninstall webhook, I came across this bug.

Error

the json value could not be converted to System.String. Cannot get the value of a token type 'Number' as a string

Config

• .Net Core 3.1.3
• ShopifySharp 5.1.0

Step to reproduce

1. Setup an uninstall webhook and a Controller to handle the webhook
2. Install your shopify app
3. Uninstall your shopify app

startup.cs

public void ConfigureServices(IServiceCollection services)
{
       services.AddControllers();
...
}

controller.cs

[HttpPost("uninstall")]
public async Task ExecuteUninstallWebhook([FromBody] Shop shop)
{
        // throws the InvalidOperationException and a 400 BadRequest
}

Hotfix

As bypass you can set NewtonsoftJson as default formatter.

1. Install Microsoft.AspNetCore.Mvc.NewtonsoftJson
2. AddNewtonsoftJson to project. startup.cs

public void ConfigureServices(IServiceCollection services)
{
       services.AddControllers().AddNewtonsoftJson();
       ...
}

However this is setting NewtonsoftJson as default formattor, making the library incompatible with .Net Core 3.0 implementation of System.Text.JSON.

Suggestion

Migrate the library to System.Text.JSON to make it compatible with .Net Core 3.0 +

[clement911]

Hi @sebastienlabine

Thanks for the report. It's not a bug. ShopifySharp was built before System.Text.JSON existed and the current version is designed to work with NewtonsoftJson. We did talk about converting to use System.Text.JSON in a future release though.

Rather than automatically deserializing the Shop object, you can do it manually. Doing it manually will give you a chance to verify that it is authentic and will not require you to use NewtonsoftJson for the rest of your MVC app.

Somethign like this:

var body = await base.ReadBodyToEndAsync();
                bool isValidRequest = AuthorizationService.IsAuthenticWebhook(Request.Headers, body, _shopifyLibOptions.SecretKey);
                if (!isValidRequest)
                {
                    throw new UnauthorizedAccessException("This request is not an authentic webhook request.");
                }
var shop = JsonConvert.DeserializeObject<Shop>(body)

[sebastienlabine]

Hi @clement911 ,

Thanks for the update.

I think it would be nice to at least specify it in the Readme, as this could be problematic for .NET Core users. Could save them some trouble.

[nozzlegear]

I agree, it should be added to the documentation. I need to go through the docs and get them updated, they're currently a little bit out of date in some areas now that we've published v5.0.

[breaker05]

Any plans on upgrading to support System.Text.JSON instead of this workaround? I ran into this issue today and saw in 5.8.0 it still has not been addressed. Thanks for everything you all do.

[clement911]

I think the ideal solution would be for every entity to implement a ToJSON / FromJSON methods so that the actual serialization mechanism is abstracted away. Indeed, it's not a good idea to rely on the internal mechanisms of a third party package, as it could break when ShopifySharp migrate to System.Text.JSON. This will probably mean we need to increment the major version when migrate.

[nozzlegear]

I agree, it'd be great to have a ToJson and FromJson method for each entity, and we can default it to the current implementation.

[clement911]

Yeah, that's what Stripe.net does. https://github.com/stripe/stripe-dotnet/blob/master/src/Stripe.net/Entities/_base/StripeEntity.cs#L95