Gate Shopify response state on established sessions - #3960
Open
frandiox wants to merge 11 commits into
Open
Conversation
Document responses can be cached and must not expose generated visitor identifiers through Server-Timing. Keep fallback tokens request-scoped while browser-side visitor-state transport remains disabled. Co-authored-by: Codex <codex@openai.com>
Parallel cold Storefront API requests can race to install conflicting browser sessions. Return captured response state only for an established essential session or the marked async consent request, keep documents clean, and prevent replayed state from being cached publicly. Co-authored-by: Codex <codex@openai.com>
Keep the compatibility reason close to the request-header plumbing so future cleanup does not remove headers that remain necessary for consumers without cookie fallback. Co-authored-by: Codex <codex@openai.com>
Essential-only sessions can coexist with legacy tracking cookies during migration. Continue forwarding those values for consumers without cookie fallback, while parsing the inbound Cookie header once for consistent presence and value lookups. Co-authored-by: Codex <codex@openai.com>
Do not replay Storefront API cookies or Server-Timing onto GET, HEAD, document, or methodless responses. This preserves shared-cache eligibility for read requests while retaining the established-session and marked-consent gates for state-changing requests. Co-authored-by: Codex <codex@openai.com>
Hydrogen should preserve legacy token compatibility without inventing identity values when no tracking state exists. Keep the modern-cookie guard so legacy values cannot override newer Shopify state. Co-authored-by: Codex <codex@openai.com>
Direct Storefront API proxy responses already carry upstream Server-Timing, bypassing the request-context replay gate. Capture that timing state before returning the proxy response so cold and cacheable requests suppress it while marked consent requests retain it. Co-authored-by: Codex <codex@openai.com>
Remove assertions that only confirm empty tracking input stays empty, while preserving coverage that injects upstream or legacy state and verifies the response gate. Also apply the required formatter output so the CI formatting check passes. Co-authored-by: Codex <codex@openai.com>
Capture upstream Storefront API cookies before removing them from direct proxy responses so the request-context consent and cacheability policy is always applied. This avoids leaking unrecognized or future upstream cookies around the gate. Co-authored-by: Codex <codex@openai.com>
Rename the existing proxy header options to requestHeaders and nest response preparation under responseHeaders.prepare so both directions have a symmetric, extensible configuration shape. Co-authored-by: Codex <codex@openai.com>
Consume proxy cookies and timing in the request context so Shopify state is gated consistently while preserving deliberate user response headers. Replay captured timing idempotently without parsing individual metrics. Co-authored-by: Codex <codex@openai.com>
frandiox
marked this pull request as ready for review
August 21, 2026 08:48
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
TL;DR
Prevent concurrent cold Storefront API responses from installing conflicting Shopify browser state before the marked consent request completes, while keeping cacheable responses free of replayed state.
Why
A new session can issue several Storefront API requests concurrently. If each response is allowed to return captured cookies or timing state, an unrelated response can race with and eclipse the response that establishes consent. The response gate needs a single explicit bootstrap path without changing established-session behavior.
What changed
Review boundary
This PR contains only the server-side response-state and token behavior. The async consent/bootstrap integration is intentionally left for a follow-up branch and should not ship until the corresponding consent-tracking-api bundle is released. Data SHS enablement is also out of scope.
Testing
Versioning
No changeset is included because this changes internal request/response coordination and does not add or change a public API.