bizz84 / bizz84/SwiftyStoreKit

Implement Local Receipt Validation as recommended by Apple

Open
#101 12 comments 2 reactions 0 assignees View on GitHub
area: receipt-validation difficulty: advanced type: enhancement
Dominant language
Swift
Stars
6.7k
Forks
801
PR merge metrics
No merged PRs in 30d

Description

As recommended by Apple, [local receipt validation](https://developer.apple.com/library/content/releasenotes/General/ValidateAppStoreReceipt/Chapters/ValidateLocally.html) can be performed with a number of steps:

To validate the receipt, perform the following tests, in order:

1. Locate the receipt.
If no receipt is present, validation fails.

2. Verify that the receipt is properly signed by Apple.
If it is not signed by Apple, validation fails.

3. Verify that the bundle identifier in the receipt matches a hard-coded constant containing the CFBundleIdentifier value you expect in the Info.plist file.
If they do not match, validation fails.

4. Verify that the version identifier string in the receipt matches a hard-coded constant containing the CFBundleShortVersionString value you expect in the Info.plist file.
If they do not match, validation fails.

5. Compute the hash of the GUID as described in Compute the Hash of the GUID.
If the result does not match the hash in the receipt, validation fails.

If all of the tests pass, validation passes.

A discussion on how this has been implemented by RMStore is here:
http://stackoverflow.com/questions/19943183/a-complete-solution-to-locally-validate-an-in-app-receipts-and-bundle-receipts-o

Also [this series](https://www.andrewcbancroft.com/2017/08/01/local-receipt-validation-swift-start-finish/) was recently published with some guidelines on how to implement local receipt validation. This links to the [SwiftyLocalReceiptValidator](https://github.com/andrewcbancroft/SwiftyLocalReceiptValidator) project on GitHub, which you can already use independently of SwiftyStoreKit.

Ongoing discussion about how SwiftyStoreKit and SwiftyLocalReceiptValidator may fit together:
https://github.com/andrewcbancroft/SwiftyLocalReceiptValidator/issues/1

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.