android in-app billing v3 api中的开发者有效负载应该是多少?

时间:2013-09-04 12:12:54

标签: android in-app-purchase in-app-billing android-billing

我正在我的应用中实施应用内结算以解锁高级功能。 应用内结算功能设置正确。除了“开发者有效载荷”之外,一切似乎都很好。

示例应用说

 /*
     * TODO: verify that the developer payload of the purchase is correct. It will be
     * the same one that you sent when initiating the purchase.
     *
     * WARNING: Locally generating a random string when starting a purchase and
     * verifying it here might seem like a good approach, but this will fail in the
     * case where the user purchases an item on one device and then uses your app on
     * a different device, because on the other device you will not have access to the
     * random string you originally generated.
     *
     * So a good developer payload has these characteristics:
     *
     * 1. If two different users purchase an item, the payload is different between them,
     *    so that one user's purchase can't be replayed to another user.
     *
     * 2. The payload must be such that you can verify it even when the app wasn't the
     *    one who initiated the purchase flow (so that items purchased by the user on
     *    one device work on other devices owned by the user).
     *
     * Using your own server to store and verify developer payloads across app
     * installations is recommended.
     */
  

示例应用使用空字符串作为开发人员有效负载。我的问题是用作开发人员有效负载的字符串是什么?   我可以使用用户的主电子邮件ID吗?

2 个答案:

答案 0 :(得分:2)

对我来说,随机字符串首先无用,它需要依赖于购买它的用户,而不是购买它的设备。其次,它是非消耗品,所以空字符串可能适合,但不是理想的。

所以我的方法是基于密钥创建加密的哈希。每次购买时,它都是唯一可识别的,因为散列应该永远不会相同(这取决于散列方法,例如bcrypt)。

由于所有设备上的密钥都相同,因此可以轻松解密并验证密码消息是否正确。

为了使密钥保持秘密,我使用了各种字符串操作函数来掩盖它,因此它不会以可见的方式存储。

可以在此处找到文本管理的示例:Android In App Billing: securing application public key

String Base64EncodedPublicKey key = DecrementEachletter("Bl4kgle") + GetMiddleBit() + ReverseString("D349824");

这种基于密钥创建散列的方法允许有效载荷是唯一且可识别的,同时具有合理的安全性。它不是防弹的,但它确实很难破解。

答案 1 :(得分:1)

请检查以下答案,它可能会解决您的问题:

如果您使用耗材项目(托管项目),则可以使用随机生成的字符串

第1步:在创建方法之前声明:

         private static final char[] symbols = new char[36];

                static {
                    for (int idx = 0; idx < 10; ++idx)
                        symbols[idx] = (char) ('0' + idx);
                    for (int idx = 10; idx < 36; ++idx)
                        symbols[idx] = (char) ('a' + idx - 10);
                }

第2步:在您的活动中设置RandomString和SessionIdentifierGenerator类

          public class RandomString {

        /*
         * static { for (int idx = 0; idx < 10; ++idx) symbols[idx] = (char)
         * ('0' + idx); for (int idx = 10; idx < 36; ++idx) symbols[idx] =
         * (char) ('a' + idx - 10); }
         */

        private final Random random = new Random();

        private final char[] buf;

        public RandomString(int length) {
            if (length < 1)
                throw new IllegalArgumentException("length < 1: " + length);
            buf = new char[length];
        }

        public String nextString() {
            for (int idx = 0; idx < buf.length; ++idx)
                buf[idx] = symbols[random.nextInt(symbols.length)];
            return new String(buf);
        }

    }

    public final class SessionIdentifierGenerator {

        private SecureRandom random = new SecureRandom();

        public String nextSessionId() {
            return new BigInteger(130, random).toString(32);
        }

    }

第3步:将有效负载传递到您的购买请求中:

RandomString randomString = new RandomString(36);
            System.out.println("RandomString>>>>" + randomString.nextString());
            /* String payload = ""; */
            // bGoa+V7g/yqDXvKRqq+JTFn4uQZbPiQJo4pf9RzJ
            String payload = randomString.nextString();
            Log.e("Random generated Payload", ">>>>>" + payload);

        Log.d(TAG, "Launching purchase flow for infinite gas subscription.");
            mHelper.launchPurchaseFlow(this, SKU_GAS,
                    IabHelper.ITEM_TYPE_INAPP, RC_REQUEST,
                    mPurchaseFinishedListener, payload);

更多信息检查此链接:    Token that identify the user

希望它能解决你的问题。