Check session expiry to trigger a re-auth

Shopify · Nov 23, 2023 · d4c371d · d4c371d
1 parent 2957c9a
commit d4c371d
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/lib/shopify_app/controller_concerns/login_protection.rb b/lib/shopify_app/controller_concerns/login_protection.rb
@@ -24,9 +24,10 @@ module LoginProtection
     ACCESS_TOKEN_REQUIRED_HEADER = "X-Shopify-API-Request-Failure-Unauthorized"
 
     def activate_shopify_session
-      if current_shopify_session.blank?
+      if current_shopify_session.blank? ||
+          (current_shopify_session.expires && current_shopify_session.expires < Time.now)
         signal_access_token_required
-        ShopifyApp::Logger.debug("No session found, redirecting to login")
+        ShopifyApp::Logger.debug("No session found or session expired, redirecting to login")
         return redirect_to_login
       end