{"id":18485,"date":"2017-07-28T14:43:58","date_gmt":"2017-07-28T18:43:58","guid":{"rendered":"https:\/\/mjtsai.com\/blog\/?p=18485"},"modified":"2023-08-09T16:01:57","modified_gmt":"2023-08-09T20:01:57","slug":"receipt-validation-in-swift","status":"publish","type":"post","link":"https:\/\/mjtsai.com\/blog\/2017\/07\/28\/receipt-validation-in-swift\/","title":{"rendered":"Receipt Validation in Swift"},"content":{"rendered":"

Andrew Bancroft<\/a>:<\/p>\n

\n

The aim of this guide is to help you take a look inside<\/em> the PKCS #7 container, and verify the presence and authenticity of the signature on the receipt.<\/p>\n<\/blockquote>\n

Andrew Bancroft<\/a>:<\/p>\n

The aim of this guide is to help you parse a receipt and decode it so that you have readable pieces of metadata to inspect and finalize all of the receipt validation steps.<\/p>\n

[…]<\/p>\n

In-app purchase receipts are encoded as ASN.1 Sets (with ASN.1 Sequences within) inside<\/em> the primary ASN.1 Set receipt payload. In other words, they’re nested<\/em> ASN.1 Sets within the overall<\/em> ASN.1 Set that encodes the whole receipt. The nested Set contains the in-app purchase<\/em> receipt attributes.<\/p><\/blockquote>\n\n

Update (2017-07-31): Andrew Bancroft<\/a>:<\/p>\n

The aim of this guide is to help you finalize the receipt validation process by computing the GUID hash for your app, and comparing it to the hash that’s stored within your receipt itself.<\/p><\/blockquote>\n\n

Update (2023-08-09): Felix Schwarz<\/a>:<\/p>\n

Two days ago I finally got annoyed enough with the OpenSSL dependency for App Store receipt parsing and validation that I had another shot at an ASN.1 parser.<\/p>

Today I have ObjC parsers for ASN.1 and PKCS#7, signature validation through Security.framework and can drop OpenSSL from my App Store project(s). 🥳<\/p>

In retrospect I wish I had found that courage earlier instead of spending a lot more time than this on getting OpenSSL to build for all the various Apple platforms and CPUs.<\/p><\/blockquote>\n\n

So much time and storage space have been collectively been wasted on this. Why couldn’t Apple have just used a plist or JSON?<\/p>\n\n

Previously:<\/p>\n