Shopify Webhook无法触发Laravel路由问题求助

1. 跳过CSRF验证 #

Laravel默认对所有POST请求做CSRF验证，而Shopify的Webhook请求不会携带CSRF令牌，必须将Webhook路由加入CSRF白名单：

打开app/Http/Middleware/VerifyCsrfToken.php，在$except数组中添加目标路由：

protected $except = [
    '/webhook/product/create',
];

2. 验证Shopify Webhook签名（必填，否则请求会被判定为非法） #

Shopify会通过X-Shopify-Hmac-SHA256请求头传递签名，必须验证该签名确保请求来自Shopify：

方式1：直接在路由中实现验证 #

use Illuminate\Http\Request;
use Illuminate\Support\Facades\Log;

Route::post('/webhook/product/create', function(Request $request){
    $hmacHeader = $request->header('X-Shopify-Hmac-SHA256');
    $shopifySecret = env('SHOPIFY_API_SECRET'); // 从.env文件获取你的Shopify API密钥

    $requestContent = $request->getContent();
    $calculatedHmac = base64_encode(hash_hmac('sha256', $requestContent, $shopifySecret, true));

    if (!hash_equals($hmacHeader, $calculatedHmac)) {
        abort(403, 'Invalid webhook signature');
    }

    // 验证通过，记录日志并处理数据
    Log::info('Shopify Product Create Webhook received', ['payload' => $request->all()]);
    
    // 返回200响应，Shopify需要收到此响应才会停止重试
    return response()->json(['status' => 'success'], 200);
});

方式2：封装为中间件（推荐，便于复用） #

创建验证中间件：

php artisan make:middleware VerifyShopifyWebhook

在app/Http/Middleware/VerifyShopifyWebhook.php中编写逻辑：

<?php

namespace App\Http\Middleware;

use Closure;
use Illuminate\Http\Request;

class VerifyShopifyWebhook
{
    public function handle(Request $request, Closure $next)
    {
        $hmacHeader = $request->header('X-Shopify-Hmac-SHA256');
        $shopifySecret = env('SHOPIFY_API_SECRET');

        if (!$hmacHeader || !$shopifySecret) {
            abort(403, 'Missing required signature or secret');
        }

        $requestContent = $request->getContent();
        $calculatedHmac = base64_encode(hash_hmac('sha256', $requestContent, $shopifySecret, true));

        if (!hash_equals($hmacHeader, $calculatedHmac)) {
            abort(403, 'Invalid webhook signature');
        }

        return $next($request);
    }
}

在app/Http/Kernel.php的$routeMiddleware中注册中间件：

protected $routeMiddleware = [
    // ...其他已注册中间件
    'shopify.webhook' => \App\Http\Middleware\VerifyShopifyWebhook::class,
];

给路由绑定中间件：

use Illuminate\Http\Request;
use Illuminate\Support\Facades\Log;

Route::post('/webhook/product/create', function(Request $request){
    Log::info('Shopify Product Create Webhook received', ['payload' => $request->all()]);
    return response()->json(['status' => 'success'], 200);
})->middleware('shopify.webhook');

3. 检查日志配置 #

确保Laravel日志功能正常：

• 确认.env文件中LOG_CHANNEL配置有效（如single或stack）
• 保证storage/logs目录有服务器写入权限
• 可临时添加error_log('Webhook triggered');到路由函数，查看服务器错误日志确认请求是否到达

4. 清理路由多余中间件 #

确保Webhook路由没有被auth这类需要登录的中间件拦截，移除不必要的中间件绑定。

完成以上操作后，重新发送Shopify测试Webhook，即可在storage/logs/laravel.log中看到日志输出。

内容的提问来源于stack exchange，提问作者kavya