search

libgdx / gdx-pay

A libGDX cross-platform API for InApp purchasing.
Apache License 2.0
225 stars 82 forks source link

How to use developerPayload in Google In-app? #38

Closed truonguit2010 closed 9 years ago

truonguit2010 commented 9 years ago

Hi, Follow Google development doc here: https://developer.android.com/google/play/billing/billing_integrate.html

Security Recommendation: When you send a purchase request, create a String token that uniquely identifies this purchase request and include this token in the developerPayload.You can use a randomly generated string as the token. When you receive the purchase response from Google Play, make sure to check the returned data signature, the orderId, and the developerPayload String. For added security, you should perform the checking on your own secure server. Make sure to verify that the orderId is a unique value that you have not previously processed, and the developerPayload String matches the token that you sent previously with the purchase request.

How can I send a developerPayload with identifier?

Thanks,

noblemaster commented 9 years ago

gdx-pay doesn't support attaching a developer payload, as it is not supported by all payment platforms (i.e. not cross-platform).

From reading the development documentation for Google Play the developer payload appears redundant to (a) the identifier you are already supplying and (b) the unique order ID that is generated for each separate order. What are you trying to accomplish using the developer payload? Are you running your own server?

If you really need it, you could modify the OpenIAB backend for gdx-pay. We currently supply a payload of null (it's in the source). You would have to add custom methods/custom handling for the payload but it's not impossible to do. However, it's not cross-platform. There is no developer payload I am aware of for iTunes. Also, are you sure you need a developer payload?

anonym24 commented 6 years ago

@noblemaster your in app purchases can be easily hacked if you aren't using payload value (anyone can get item for free)

noblemaster commented 6 years ago

You need to do a server side verification & only deliver content upon server side verification. A developer payload doesn't prevent people from getting products for free. Please read the "Security Best Practices" for details: https://developer.android.com/google/play/billing/billing_best_practices

Any purchases can be hacked with local verification only (non-server based). A developer payload will help little to solve your problem.