Using customer object information in private app

Question

I'm currently trying to build a private app which will allow me to create a form which customers can use to update info like name, email address, etc.

I know that I can access this information in my template through the customer object:

https://help.shopify.com/themes/liquid/objects/customer

I also believe that I can send http requests through the admin api which would allow me to update a given customer object:

https://help.shopify.com/api/reference/customer#update

This is an example PUT request from that page

PUT /admin/customers/#{id}.json
{
  "customer": {
    "id": 207119551,
    "email": "[email protected]",
    "note": "Customer is a great guy"
  }
}

I think that in order to use this api (or at least use it securely) I need to use a private app. I found the following npm package which I would use to create the private app:

https://www.npmjs.com/package/shopify-node-api

This is an example of a PUT request from that page (I think this can be modified for customers):

var put_data = {
  "product": {
    "body_html": "<strong>Updated!</strong>"
  }
}
Shopify.put('/admin/products/1234567.json', put_data, function(err, data, headers){
  console.log(data);
});

Does anyone have any experience doing this as I'm unsure about a few things.

Will this PUT request be called when the url is loaded? So if I have an <a> tag with href="/admin/products/1234567.json the request would load?
If so, this seems quite useless with the customer ID hardcoded in. Can I pass in the customer ID of whoever is logged in and clicking the link and use that as the last part of the request url somehow? In addition to this would it be possible to grab the form data that the user enters to use as the value for "email" or "note?

Outside of app context, you can update the customer address using {% form 'customer_address', customer.new_address %} else you will need to get into app proxies, and complex authentication to stop hackers. — GeorgeButter

bknights bknights · Accepted Answer · 2017-07-12T22:03:32

You should check out this answer shopify app proxy: send customer data or only customer ID for some pointers, discussion and links.

tl/dr; Don't rely on only the logged in customer id or you'll be opening yourself up to easy hackery.

So bascially you update the customer with the PUT you outlined in your question. To get the id securely you: Create a form with the customer id and make sure you have a server generated hash of that customer id to thwart bots (that's the reference post)

You post the customer data to a an app via a proxy url

You update the customer via a PUT to a constructed url.

Using customer object information in private app

1 Answers