2

My app is making in-app purchases and later sending the relevant data to a server backend to verify via a service account and store for later. I notice the backend is receiving a lot of spam purchase receipts with invalid tokens that are all failing the verification request. The majority of requests I end up making are destined to fail.

Is there a way I can verify that the purchase token is at least likely to be legit before I bother with a request? Is it signed by google in some way that can be checked? I swear I read something on this subject while I was implementing it but now can't find anything.

If this is something I need to implement myself that is fine, just would like to know if there are alternatives as I thought I read something on this topic.

Thanks!

savanto
  • 4,470
  • 23
  • 40
Esaptonor
  • 143
  • 8

1 Answers1

3

As you already know, the only way to truly verify a purchase token as being legitimate is to do so from the backend via the in-app billing API. And as far as I know there is no way to 100% accurately pre-verify a token. But if you are willing to accept some margin of error...

Token format

In my experience, as of February 2016, invalid purchase tokens come in three formats:

Correctly formatted tokens, on the other hand, are long tokens with two parts: 24 alpha characters, dot (.), and a second part that starts with AO-J1O..., eg. olcgkklnpigiceancikanedj.AO-J1O...

Rootedness

Users that attempt to make fraudulent purchases comprise a substantial percentage of all checkout attempts. Furthermore, they often attempt to checkout multiple times. Nearly all of these attempts come from rooted devices. I strongly believe that having a rooted device is everyone's right, and that there are legitimate reasons for having a rooted device. However, it also seems that having root is a requirement for attempting fraudulent purchases. I use this (imperfect) method to determine whether a device is rooted.

Conclusion

I do not suggest that you treat all rooted users as fraudulent hackers. But in my limited experience, rooted devices that generate malformed tokens are likely to receive an "invalid token" error. This is by no means a perfect method, since

  • Rooted devices have also generated valid tokens for me
  • Un-rooted devices have generated invalid tokens for me
  • Most importantly, I believe that "malformed" tokens are merely emulating an obsolete token format. As Google changes the token format, so too will the authors of the hacking apps change their fake tokens to match that format. You will have to stay on top of these developments, and accept a certain margin of false positives and false negatives.

Please see my other answer for more details on this issue.

Community
  • 1
  • 1
savanto
  • 4,470
  • 23
  • 40