Post not yet marked as solved
Post marked as unsolved with 3 replies, 1,937 views
I have started implementing support for the new App Store Server notifications (version 2):
https://developer.apple.com/documentation/appstoreservernotifications/receiving_app_store_server_notifications
I am not sure how to prevent a possible mad-in-the-middle attack when using those notifications. The decoded header that I get for notifications in the Sandbox environment is missing the "kid" field that is used to identify the key used to generate a signature.
Yes, I understand the the whole entire certificate chain is available in the "x5c" field and it could be verified by itself. However, this does not guarantee that a notification was signed by Apple.
This approach (with no specific key, with a certificate chain in x5c) works fine when verifying a receipt on device with StoreKit 2 but it does not work when getting a notification on a server.