The default bug view has changed. See this FAQ.

Implement navigator.mozApps.verifyReceipt

RESOLVED WONTFIX

Status

()

Core
DOM
P1
normal
RESOLVED WONTFIX
5 years ago
4 years ago

People

(Reporter: anant, Unassigned)

Tracking

Firefox Tracking Flags

(Not tracked)

Details

(Reporter)

Description

5 years ago
Currently verifyReceipt is implemented, but only for the native-shell: https://github.com/mozilla/openwebapps/blob/develop/addons/jetpack/data/native-install/XUL/content/window.js#L142

This code should be shared across all the other mozApps implementations, which are currently the add-on and HTML5 shim.
(Reporter)

Updated

5 years ago
Depends on: 701409

Updated

5 years ago
Depends on: 709288
(Reporter)

Updated

5 years ago
Duplicate of this bug: 710289
(Reporter)

Updated

5 years ago
Priority: P2 → P1

Updated

5 years ago
Component: General → DOM: Mozilla Extensions
Product: Web Apps → Core
QA Contact: general → general
Did this feature get implemented? What's the status on this?

Updated

5 years ago
Whiteboard: [mozappsapi]
(In reply to Jason Smith from comment #2)
> Did this feature get implemented? What's the status on this?

It's not implemented on m-c.
Whiteboard: [mozappsapi] → [mozApps API 1.0]

Comment 4

5 years ago
There's an open design question here: do we still want to implement verifyReceipt?
(In reply to Ian Bicking (:ianb) from comment #4)
> There's an open design question here: do we still want to implement
> verifyReceipt?

What benefits does our stakeholders using verifyReceipt get for it existing? What cost is lost for it not existing?

Clarification - Is verifyReceipt a convenience function to operate against marketplace's receipt validation service? Or it something else?

Comment 6

5 years ago
For the most part, verifyReceipt could be implemented as a JS file, a kind of helper that we provide, but don't need to specifically include as part of the mozApps API.  That is, there's no special abilities we need, and no hard security advantage to providing it natively (though there might be some soft advantages).

I believe the actual verifyReceipt function was probably too complicated to be part of the mozApps API - it also included some options for various levels of app security.  We'd want to distill a smaller API from it, and allow supporting libraries cover app policies.
(Reporter)

Comment 7

5 years ago
Ian is right, there are no hard advantages to including it as part of the mozApps API (and is definitely not part of the spec). The original implementation in the add-on served two purposes:

- A vehicle to prototype apps that depended on receipt validation quickly
- Provide sample code to app developers who wanted to know what the "right" way to validate a receipt was

Most serious developers will want to do receipt verification themselves, but for some smaller scale apps the thinking was that verifyReceipt() would serve as a nice convenience function, when the app developer trusts the web run-time to a certain extent.

Updated

5 years ago
Blocks: 746465

Updated

5 years ago
Whiteboard: [mozApps API 1.0]
Is this bug still valid, given that Ian is actively working on https://github.com/mozilla/receiptverifier to be integrated into mozmarket.js per bug 755006 and bug 758733?

Comment 9

5 years ago
I believe the library supersedes this function.
Okay. Resolving as a won't fix then.
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → WONTFIX
(Assignee)

Updated

4 years ago
Component: DOM: Mozilla Extensions → DOM
Product: Core → Core
You need to log in before you can comment on or make changes to this bug.