Use new header name for secret storefront token (#1037)

* Update logic and name of storefront secret token * Fix bug in Stackblitz and, really, the whole world * Add changeset
Shopify · Apr 5, 2022 · 13376ef · 13376ef
1 parent 0348808
commit 13376ef
Show file tree

Hide file tree

Showing 3 changed files with 17 additions and 3 deletions.
diff --git a/.changeset/unlucky-eels-push.md b/.changeset/unlucky-eels-push.md
@@ -0,0 +1,5 @@
+---
+'@shopify/hydrogen': patch
+---
+
+Use new header for private Storefront token
diff --git a/packages/hydrogen/src/framework/Hydration/ServerComponentRequest.server.ts b/packages/hydrogen/src/framework/Hydration/ServerComponentRequest.server.ts
@@ -184,8 +184,9 @@ function getInitFromNodeRequest(request: any) {
         : undefined,
   };
 
-  if (!init.headers.has('x-forwarded-for')) {
-    init.headers.set('x-forwarded-for', request.socket.remoteAddress);
+  const remoteAddress = request.socket.remoteAddress;
+  if (!init.headers.has('x-forwarded-for') && remoteAddress) {
+    init.headers.set('x-forwarded-for', remoteAddress);
   }
 
   return init;

diff --git a/packages/hydrogen/src/hooks/useShopQuery/hooks.ts b/packages/hydrogen/src/hooks/useShopQuery/hooks.ts
@@ -171,6 +171,15 @@ function useCreateShopRequest(body: string, locale?: string) {
 
   const extraHeaders = {} as Record<string, any>;
 
+  /**
+   * Only pass one type of storefront token at a time.
+   */
+  if (secretToken) {
+    extraHeaders['Shopify-Storefront-Private-Token'] = secretToken;
+  } else {
+    extraHeaders['X-Shopify-Storefront-Access-Token'] = storefrontToken;
+  }
+
   if (buyerIp) {
     extraHeaders['Shopify-Storefront-Buyer-IP'] = buyerIp;
   }
@@ -182,7 +191,6 @@ function useCreateShopRequest(body: string, locale?: string) {
       body,
       method: 'POST',
       headers: {
-        'X-Shopify-Storefront-Access-Token': secretToken ?? storefrontToken,
         'X-SDK-Variant': 'hydrogen',
         'X-SDK-Version': storefrontApiVersion,
         'content-type': 'application/json',