Hi,
I have recently started studying the development platform provided by Shopify and I am trying to create my first application.
I know that Shopify provides a handy CLI to essentially create a skeleton of an application with everything already configured. But, since the I am not really comfortable with the languages supported I have decided to build everything from scratch with a language I am already familiar with.
I followed the documentation provided here (https://shopify.dev/docs/apps/auth/oauth/getting-started) and I was able to successfully implement a basic application.
I have noticed Shopify has been pushing developers to use session tokens (https://shopify.dev/docs/apps/auth/oauth/session-tokens/getting-started)) instead of cookies, no problems I can look into it as well.
So my understanding is that the platform will deprecate cookies at some point, but the OAuth documentation clearly states we should be using cookies. More precisely, to store a nonce value the application randomly generates and associate it to the state query parameter when redirecting to the authorize endpoint. The same value is passed back by Shopify when redirecting back to the app with the authorization code. At this point the app should check if the nonce value matches the value stored in the cookie/session, essentially providing a security layer against CSRF attacks, I believe.
So, how do I completely replace cookies with access tokens in my application if the documentation itself states they are still required?. Should I use cookies only for the step I mentioned and do everything else with session tokens or what?.