Android帐单V3开发人员有效载荷策略

Question

该问题与Google Play Billing有关。和建议的示例Trivial Drive。

如“最佳做法”页面所述，建议在购买时进行验证。

/** Verifies the developer payload of a purchase. */
boolean verifyDeveloperPayload(Purchase p) {
    String payload = p.getDeveloperPayload();

    /*
     * TODO: verify that the developer payload of the purchase is correct. It will be
     * the same one that you sent when initiating the purchase.
     *
     * WARNING: Locally generating a random string when starting a purchase and
     * verifying it here might seem like a good approach, but this will fail in the
     * case where the user purchases an item on one device and then uses your app on
     * a different device, because on the other device you will not have access to the
     * random string you originally generated.
     *
     * So a good developer payload has these characteristics:
     *
     * 1. If two different users purchase an item, the payload is different between them,
     *    so that one user's purchase can't be replayed to another user.
     *
     * 2. The payload must be such that you can verify it even when the app wasn't the
     *    one who initiated the purchase flow (so that items purchased by the user on
     *    one device work on other devices owned by the user).
     *
     * Using your own server to store and verify developer payloads across app
     * installations is recommended.
     */

    return true;

你们对使用google firebase作为后端发送服务器响应有何想法？那可能吗？还是有更好的方法？

我们必须谨记要在多个设备上识别用户，因此不能使用android ID。

顺便说一句，为什么Google不为我们处理所有这些东西？