Transaction verification

I believe the issue has not been 'solved' as far as preventing hacks but it has been 'solved' in that there is a verification procedure that allows you to do one of the following:

1) decode a receipt delivered with the purchase using OpenSSL - it's a bit hard but can be done, and it's very secure since each receipt is encoded based on the device's unique identifierForVendor

2) grab the receipt and send it to your server - this requires secure transmission to avoid a man-in-the-middle attack and requires that your server watch out for duplicate receipts because it does not have a device-specific field

3) grab the receipt and send it from the device to Apple servers and get back a response on the device - this is easy but may be subject to a fairly sophisticated hack in which the transmission to Apple is diverted.

And here is the link to Apple document:

https://developer.apple.com/library/ios/releasenotes/General/ValidateAppStoreReceipt/Introduction.html

So yeah it looks like I'll need to use the verification class, if it still works. Doing it server side isn't the worst headache but since UDID's are no longer available I'd have to rewrite a lot of code.

You can't use VerificationController or VerificationControllerPBKSimple because they rely on transaction.transactionReceipt and that is deprecated. You will need to write your own code to decode the receipt on the device.

I suppose I have one more question.

The purchases are weapons, and the weapon data and models are not included in the app. I have hosted them with apple. So with that in mind, if someone does manage to hack the system and fake a verified receipt, will the content still download?

I do not know if a hacker can capture and copy the transaction.downloads object from one valid purchase on one device and resubmit it to other devices thereby emulating a valid purchase. But it would not surprise me if they could. At the very least I would send the receipt from the device to the Apple servers and verify that it is valid and that the receipt's request_date comes after the purchase_date.

>will the content still download?

They probably wouldn't bother faking a receipt if it didn't, so...

Seen this?

w w w . gamasutra.com/blogs/AndreiMihu/20150709/248126/Defend_your_games_against_InApp_Purchase_attacks.php

This is not what OP asked for, but one might find useful this code I posted to check the UID hash of an appreceipt server side:

NOTE: the previous post does not appear correctly in the forum under IAP!!!! Perhaps because it has a link in it.

Thanks for posting a method to check the UUID hash of an appreceipt server side. It fills in a security flaw in Apple's system. A necessary operation for anyone thinking they are actually validating receipts using a remote server. Especially because the transaction_id is not unique when a user repurchases an item.