Skip CSRF check if a valid JWT is passed in

app/controllers/shopify_app/authenticated_controller.rb

@@ -3,6 +3,12 @@ module ShopifyApp
   class AuthenticatedController < ActionController::Base
     include ShopifyApp::Authenticated
 
-    protect_from_forgery with: :exception
+    protect_from_forgery with: :exception, unless: :valid_jwt_header?
+
+    private
+
+    def valid_jwt_header?
+      jwt_shopify_domain.present?
+    end
   end
 end