1021359 - Enable product verification for in-app purchase receipts

Status: RESOLVED FIXED

(Marketplace Graveyard :: Payments/Refunds, defect, P2)

Description

[Kumar McMillan [:kumar]]

An in-app purchase receipt currently gets validated for having the right signature and for having an existing contribution object in the Marketplace db. A vendor also needs a way to verify that the receipt is for the right *product*. In other words, an attacker could pass a perfectly valid in-app receipt to the vendor but one for the wrong product. The vendor needs a way to prevent that.

For app purchases, the vendor does this by verifying the productURL. See https://github.com/mozilla/receiptverifier#options

We need to think of what data to put in the receipt to enable in-app product verification.

Comment 1

[Jared Kerim [:jkerim]]

Merged in https://github.com/mozilla/zamboni/pull/2190