738368 - Allow developers to revoke compromised in-app payment secret

Status: VERIFIED FIXED

(addons.mozilla.org Graveyard :: Developer Pages, defect, P2)

Description

[Kumar McMillan [:kumar]]

If an app developer *knows* their in-app payment secret has been compromised, they need a way to disable the secret ASAP. This should be a feature on the developer hub management screen.

The management screen for key/secret was built in bug 703093

Comment 1

[Wil Clouser [:clouserw]]

Is this documented somewhere?  https://wiki.mozilla.org/Apps/WebApplicationReceipt/GenerationService covers our keys, but I haven't seen anything about in-app purchases.  I'm curious about effects for the end user - will they migrate to a new key, or..?

Comment 2

[Kumar McMillan [:kumar]]

In this case I think the app developer would just regenerate the key/secret and update their hopefully no longer compromised app. This feature would need to be documented on https://developer.mozilla.org/en/Apps/In-app_payments

Comment 3

[Mark Giffin [:markg]]

I have added info on how to handle a compromised app secret to MDN here:
https://developer.mozilla.org/en/Apps/In-app_payments#section_5

Comment 4

[Kumar McMillan [:kumar]]

Fixed:
https://github.com/mozilla/zamboni/commit/e576444a5397490e8d9f9634d8f78adafdf8c674

Devs now get a button to reset their credentials on the Manage In-App Payments page, like this: https://marketplace-dev.allizom.org/en-US/developers/app/in-app-payment-tester-10/in-app-config

I've updated the MDN docs too: https://developer.mozilla.org/en/Apps/In-app_payments#Revoking_a_compromised_app_secret

Comment 5

[krupa raj[:krupa]]

verified at https://marketplace-dev.allizom.org/en-US/developers/app/in-app-payment-tester/in-app-config

Checked that in-app payments are unsuccessful if Application secret is revoked.

Comment 6

[krupa raj[:krupa]]

Attachment: post-fix screenshot

Comment 7

[krupa raj[:krupa]]

Attachment: post-fix screenshot