ignore unknown messages by kiftio · Pull Request #287 · Shopify/checkout-kit

kiftio · 2026-06-16T11:41:50Z

What changes are you making?

PR 1 -> parity with web r.e. an allowlist of events

Previously, the SDK responded to certain unsupported ECP methods (e.g. ec.auth, ec.payment.credential_request) with an explicit JSON-RPC -32601 "method not supported" error, and forwarded any unknown methods to the consumer CheckoutCommunicationClient. This approach exposed internal protocol details and allowed arbitrary unrecognized methods to reach the client.

This PR replaces that behavior with an explicit allow-list of supported protocol methods on both Android and iOS:

Android: Replaces UNSUPPORTED_METHODS (which sent explicit error responses) with SUPPORTED_CLIENT_METHODS, an allow-list aligned with the web component's CHECKOUT_PROTOCOL_MESSAGES. Methods outside this list — including ep.*, ec.auth, and any unknown methods — are now silently ignored rather than forwarded or rejected with an error.
iOS: Adds a supportedProtocolMethods allow-list in CheckoutWebView. Incoming messages are parsed and their method checked against this list before any further processing or client delegation occurs. Messages with unsupported methods are dropped silently.
The CheckoutCommunicationClient documentation is updated on both platforms to clarify that only supported ECP messages are forwarded to the client.

How to test

Send an ECP message with an unsupported method (e.g. ec.auth, ec.payment.credential_request, ep.cart.ready, or a custom unknown method) to the bridge on both Android and iOS.
Verify no JSON-RPC error response is sent back to the web page.
Verify the consumer CheckoutCommunicationClient does not receive the message.
Send a supported ECP message (e.g. ec.window.open_request, ec.messages.change) and verify it is still correctly delegated to the client and any response is forwarded back to the web page.
Run the updated unit tests on both platforms to confirm all cases pass.

Before you merge

Important

I've added tests to support my implementation
I have read and agree with the Contribution Guidelines
I have read and agree with the Code of Conduct
I've updated the relevant platform README (platforms/swift/README.md and/or platforms/android/README.md)

Releasing a new Swift version?

I have bumped the version in ShopifyCheckoutKit.podspec
I have bumped the version in platforms/swift/Sources/ShopifyCheckoutKit/ShopifyCheckoutKit.swift
I have updated platforms/swift/CHANGELOG.md
I have updated the SwiftPM/CocoaPods version snippets in platforms/swift/README.md (major version only)

Releasing a new Android version?

I have bumped the versionName in platforms/android/lib/build.gradle
I have updated platforms/android/CHANGELOG.md
I have updated the Gradle/Maven version snippets in platforms/android/README.md

Tip

See the Contributing documentation for the full release process per platform.

kiftio · 2026-06-16T11:42:05Z

hide communication client #288
remove buyer change in web #290
Use typed Android JSON-RPC params #300
Use typed Swift JSON-RPC envelopes #299
respond to unknown requests with error #289
ignore unknown messages #287 👈 (View in Graphite)
main

This stack of pull requests is managed by Graphite. Learn more about stacking.

kiftio · 2026-06-16T11:53:04Z

-        }
-        assertThat(js).contains("\"error\"")
-        assertThat(js).contains("-32601")
+    fun `ec auth is silently ignored and not delegated to client`() {


bringing this back in PR 3, but across all platforms

github-actions · 2026-06-16T12:29:11Z

React Native — Coverage Report

Lines	Statements	Branches	Functions
	91.66% (319/348)	87.86% (181/206)	100% (82/82)

kieran-osgood-shopify · 2026-06-17T12:38:07Z

+extension CheckoutWebView {
+    fileprivate static let readyMethod = "ec.ready"
+
+    fileprivate static let supportedProtocolMethods: Set<String> = [


CheckoutProtocol is an enum of the events we support
Should we add CaseIterable to it so we can get all supported cases with CheckoutProtocol.allCases

kieran-osgood-shopify · 2026-06-17T12:40:35Z

+        CheckoutProtocol.windowOpen.method
+    ]
+
+    fileprivate static func supportedProtocolMethod(_ body: String) -> String? {


feels like this would make sense to exist in the protocol side too

markmur · 2026-06-17T12:50:43Z

+extension CheckoutWebView {
+    fileprivate static let readyMethod = "ec.ready"
+
+    fileprivate static let supportedProtocolMethods: Set<String> = [
+        readyMethod,
+        CheckoutProtocol.start.method,
+        CheckoutProtocol.complete.method,
+        CheckoutProtocol.error.method,
+        CheckoutProtocol.lineItemsChange.method,
+        CheckoutProtocol.messagesChange.method,
+        CheckoutProtocol.totalsChange.method,
+        CheckoutProtocol.windowOpen.method
+    ]
+
+    fileprivate static func supportedProtocolMethod(_ body: String) -> String? {
+        guard
+            let object = try? JSONSerialization.jsonObject(with: Data(body.utf8)) as? [String: Any],
+            object["jsonrpc"] as? String == "2.0",
+            let method = object["method"] as? String,
+            supportedProtocolMethods.contains(method)
+        else {
+            return nil
+        }
+
+        return method
+    }
+}


On the protocol side, we're already only binding to a limited set of events →

checkout-kit/protocol/languages/swift/Sources/ShopifyCheckoutProtocol/CheckoutProtocol.swift

Lines 1 to 17 in 7625978

public enum CheckoutProtocol {

public static let specVersion = "2026-04-08"

public static let defaultDelegations: [String] = ["window.open"]

static let buyerChange = NotificationDescriptor<Checkout>(method: "ec.buyer.change")

public static let complete = NotificationDescriptor<Checkout>(method: "ec.complete")

public static let error = NotificationDescriptor<ErrorResponse>(method: "ec.error")

public static let lineItemsChange = NotificationDescriptor<Checkout>(

method: "ec.line_items.change"

)

public static let messagesChange = NotificationDescriptor<Checkout>(

method: "ec.messages.change"

)

public static let start = NotificationDescriptor<Checkout>(method: "ec.start")

public static let totalsChange = NotificationDescriptor<Checkout>(method: "ec.totals.change")

}

So this feels duplicative, but, saying that, if we were to extend the protocol to expose it as separate package we would need to bind the relevant ones here.

What do you think about keeping this logic in the protocol until this is needed?

This was referenced Jun 16, 2026

hide communication client #288

Draft

respond to unknown requests with error #289

Open

kiftio force-pushed the dk/ignore-unknown-messages branch from 7156a26 to b2500fb Compare June 16, 2026 11:51

kiftio commented Jun 16, 2026

View reviewed changes

kiftio force-pushed the dk/ignore-unknown-messages branch from b2500fb to b61158a Compare June 16, 2026 12:24

kiftio marked this pull request as ready for review June 16, 2026 12:28

kiftio requested a review from a team as a code owner June 16, 2026 12:28

kiftio mentioned this pull request Jun 16, 2026

remove buyer change in web #290

Open

11 tasks

kiftio force-pushed the dk/ignore-unknown-messages branch from b61158a to 4b0d021 Compare June 16, 2026 12:48

kieran-osgood-shopify reviewed Jun 17, 2026

View reviewed changes

tiagocandido approved these changes Jun 17, 2026

View reviewed changes

markmur reviewed Jun 17, 2026

View reviewed changes

ignore unknown messages

e711cb0

kiftio force-pushed the dk/ignore-unknown-messages branch from 4b0d021 to e711cb0 Compare June 18, 2026 09:06

markmur approved these changes Jun 18, 2026

View reviewed changes

kieran-osgood-shopify approved these changes Jun 18, 2026

View reviewed changes

kiftio merged commit 86e9f2e into main Jun 18, 2026
26 checks passed

kiftio deleted the dk/ignore-unknown-messages branch June 18, 2026 10:05

This was referenced Jun 18, 2026

Use typed Swift JSON-RPC envelopes #299

Open

Use typed Android JSON-RPC params #300

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ignore unknown messages#287

ignore unknown messages#287
kiftio merged 1 commit into
mainfrom
dk/ignore-unknown-messages

kiftio commented Jun 16, 2026 •

edited

Loading

Uh oh!

kiftio commented Jun 16, 2026 •

edited

Loading

Uh oh!

kiftio Jun 16, 2026

Uh oh!

github-actions Bot commented Jun 16, 2026 •

edited

Loading

Uh oh!

kieran-osgood-shopify Jun 17, 2026

Uh oh!

kieran-osgood-shopify Jun 17, 2026

Uh oh!

markmur Jun 17, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

	public enum CheckoutProtocol {
	public static let specVersion = "2026-04-08"

	public static let defaultDelegations: [String] = ["window.open"]

	static let buyerChange = NotificationDescriptor<Checkout>(method: "ec.buyer.change")
	public static let complete = NotificationDescriptor<Checkout>(method: "ec.complete")
	public static let error = NotificationDescriptor<ErrorResponse>(method: "ec.error")
	public static let lineItemsChange = NotificationDescriptor<Checkout>(
	method: "ec.line_items.change"
	)
	public static let messagesChange = NotificationDescriptor<Checkout>(
	method: "ec.messages.change"
	)
	public static let start = NotificationDescriptor<Checkout>(method: "ec.start")
	public static let totalsChange = NotificationDescriptor<Checkout>(method: "ec.totals.change")
	}

Conversation

kiftio commented Jun 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What changes are you making?

How to test

Before you merge

Uh oh!

kiftio commented Jun 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kiftio Jun 16, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Jun 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

React Native — Coverage Report

Uh oh!

kieran-osgood-shopify Jun 17, 2026

Choose a reason for hiding this comment

Uh oh!

kieran-osgood-shopify Jun 17, 2026

Choose a reason for hiding this comment

Uh oh!

markmur Jun 17, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

kiftio commented Jun 16, 2026 •

edited

Loading

kiftio commented Jun 16, 2026 •

edited

Loading

github-actions Bot commented Jun 16, 2026 •

edited

Loading