Test app network access configuration on dev stores
Source: Shopify Dev Changelog
Shopify Adds Network Access Testing for Dev Stores
What Changed
Shopify has introduced a new feature preview called network_access_testing that allows developers to test their app’s [network_access] configuration directly on a development store. This feature helps confirm whether network settings behave as expected before deploying to production.
When enabled on a dev store, the testing feature verifies specific behaviors tied to the network_access configuration block. Links pointing to hosts not listed in allowed_navigation_hosts now trigger the exit warning dialog, giving developers a way to confirm that unauthorized navigation attempts are properly flagged. This allows teams to validate their allowlist configuration against real navigation paths within the app.
Why This Matters
Apps that embed external links or redirect users to third-party domains must declare those domains in their network_access settings, specifically within allowed_navigation_hosts. Misconfigured or incomplete allowlists can result in either broken user flows or unintended security gaps, where navigation to unlisted hosts fails silently or behaves inconsistently across environments.
Previously, developers had limited ways to verify this configuration without deploying to a live environment or relying on inconsistent manual testing. This feature preview closes that gap by providing a controlled dev store environment where network access rules can be validated before release.
Practical Implications
Developers working with embedded apps, checkout extensions, or any functionality that triggers outbound navigation should enable this feature preview on a dev store to audit their current network_access configuration. This is particularly relevant for apps integrating third-party services, analytics providers, or external authentication flows, where missed hosts in the allowlist could disrupt user experience post-launch.
Teams should review their existing allowed_navigation_hosts list against all outbound links and redirects in their app, using this testing feature to catch gaps before submitting updates for app review or deploying to merchant stores.