Closed Bug 1024057 Opened 10 years ago Closed 10 years ago

fxpay: reject valid receipts for the wrong inapp_id

Categories

(Marketplace Graveyard :: Payments/Refunds, defect)

Product:
Marketplace Graveyard
Component:
Payments/Refunds
Platform:
x86
macOS
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

(Not tracked)

Status:
RESOLVED FIXED

People

(Reporter: kumar, Assigned: kumar)

References

Details

(Whiteboard: [qa-]) 

If a valid receipt is on device but it's for the wrong in-app product ID, it should be rejected. The inapp_id value was added to receipts (via storedata) in bug 1021359
Blocks: 956358
Whiteboard: [qa-]
Assignee: nobody → kumar.mcmillan
Fixed but with a new approach: https://github.com/mozilla/fxpay/pull/17

The developer must declare their app ID. This enables the library to reject any receipts belonging to other apps. This seemed to make more sense than whitelisting every possible product ID. A receipt for an invalid product ID (which is unlikely) will naturally not work because onrestore() already relies on product IDs.
Status: NEW → RESOLVED
Closed: 10 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.