PHP服务器上的iOS 7收据验证问题答案

【问题标题】：iOS 7 receipt validation issue on PHP serverPHP服务器上的iOS 7收据验证问题
【发布时间】：2014-03-21 19:50:20
【问题描述】：

2 天的不间断搜索，我对 IAP 的一个重要问题一无所知。我们需要我们的服务器来验证收据，并且响应总是 21002。

在我发送的客户端上

NSURL *receiptURL = [[NSBundle mainBundle] appStoreReceiptURL];
NSData *receipt = [NSData dataWithContentsOfURL:receiptURL];
NSDictionary* post = @{@"receipt":[receipt base64EncodedStringWithOptions:0]};
[ServerRequest requestWithUrl:url Callback:nil SendToIM:NO PostData:post];//does standard _POST to our php server

这是一个沙盒收据，在它到达服务器之前是一个 base64 字符串

MIIU2gYJKoZIhvcNAQcCoIIUyzCCFMcCAQExCzAJBgUrDgMCGgUAMIIEiwYJKoZIhvcNAQcBoIIEfASCBHgxggR0MAoCAQgCAQEEAhYAMAoCARICAQEEAhYAMAoCARMCAQEEAgwAMAoCARQCAQEEAgwAMAsCAQECAQEEAwIBADALAgELAgEBBAMCAQAwCwIBDgIBAQQDAgFTMAsCAQ8CAQEEAwIBADALAgEQAgEBBAMCAQAwCwIBGQIBAQQDAgEDMAwCAQoCAQEEBBYCNCswDQIBAwIBAQQFDAMwLjYwDQIBDQIBAQQFAgMBEdQwDgIBCQIBAQQGAgRQMjI4MBgCAQQCAQIEEM7oReI9bPs0X/hqFDngWuUwGwIBAAIBAQQTDBFQcm9kdWN0aW9uU2FuZGJveDAcAgEFAgEBBBQ8LF7D7deEfXmQd9NITmWuDFXXkDAeAgEMAgEBBBYWFDIwMTQtMDMtMjFUMTk6NDU6MDhaMCwCAQICAQEEJAwiY29tLmNsaXB3aXJlZ2FtZXMuQ3JpdHRlci1Db25xdWVzdDA4AgEHAgEBBDBrGHw8H08L2bC6tSu08pjZKzOeXY8iNjZxZFrJSPr1QnpwMtHhPd44Lky0BciZY0wwOwIBBgIBAQQz4eLimps057PHKFJAyTiNF4fTO5uWOQQkM1dk2ivH6xnWf3/e8qD+9GzS2HH2qzIzZvonMIIBTAIBEQIBAQSCAUIxggE+MAsCAgasAgEBBAIWADALAgIGrQIBAQQCDAAwCwICBrACAQEEAhYAMAsCAgayAgEBBAIMADALAgIGswIBAQQCDAAwCwICBrQCAQEEAgwAMAsCAga1AgEBBAIMADALAgIGtgIBAQQCDAAwDAICBqUCAQEEAwIBATAMAgIGqwIBAQQDAgEBMAwCAgauAgEBBAMCAQAwDAICBq8CAQEEAwIBADAMAgIGsQIBAQQDAgEAMBICAgamAgEBBAkMB0dlbXM1MDAwGwICBqcCAQEEEgwQMTAwMDAwMDEwNTI3MTk4ODAbAgIGqQIBAQQSDBAxMDAwMDAwMTA1MjcxOTg4MB8CAgaoAgEBBBYWFDIwMTQtMDMtMjFUMTk6NDU6MDhaMB8CAgaqAgEBBBYWFDIwMTQtMDMtMjFUMTU6MTM6NDdaMIIBTAIBEQIBAQSCAUIxggE+MAsCAgasAgEBBAIWADALAgIGrQIBAQQCDAAwCwICBrACAQEEAhYAMAsCAgayAgEBBAIMADALAgIGswIBAQQCDAAwCwICBrQCAQEEAgwAMAsCAga1AgEBBAIMADALAgIGtgIBAQQCDAAwDAICBqUCAQEEAwIBATAMAgIGqwIBAQQDAgEBMAwCAgauAgEBBAMCAQAwDAICBq8CAQEEAwIBADAMAgIGsQIBAQQDAgEAMBICAgamAgEBBAkMB0dlbXM1MDAwGwICBqcCAQEEEgwQMTAwMDAwMDEwNTI5NTk3NDAbAgIGqQIBAQQSDBAxMDAwMDAwMTA1Mjk1OTc0MB8CAgaoAgEBBBYWFDIwMTQtMDMtMjFUMTk6NDU6MDhaMB8CAgaqAgEBBBYWFDIwMTQtMDMtMjFUMTk6NDU6MDhaoIIOVTCCBWswggRToAMCAQICCBhZQyFydJz8MA0GCSqGSIb3DQEBBQUAMIGWMQswCQYDVQQGEwJVUzETMBEGA1UECgwKQXBwbGUgSW5jLjEsMCoGA1UECwwjQXBwbGUgV29ybGR3aWRlIERldmVsb3BlciBSZWxhdGlvbnMxRDBCBgNVBAMMO0FwcGxlIFdvcmxkd2lkZSBEZXZlbG9wZXIgUmVsYXRpb25zIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTEwMTExMTIxNTgwMVoXDTE1MTExMTIxNTgwMVoweDEmMCQGA1UEAwwdTWFjIEFwcCBTdG9yZSBSZWNlaXB0IFNpZ25pbmcxLDAqBgNVBAsMI0FwcGxlIFdvcmxkd2lkZSBEZXZlbG9wZXIgUmVsYXRpb25zMRMwEQYDVQQKDApBcHBsZSBJbmMuMQswCQYDVQQGEwJVUzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALaTwrcPJF7t0jRI6IUF4zOUZlvoJze/e0NJ6/nJF5czczJJSshvaCkUuJSm9GVLO0fX0SxmS7iY2bz1ElHL5i+p9LOfHOgo/FLAgaLLVmKAWqKRrk5Aw30oLtfT7U3ZrYr78mdI7Ot5vQJtBFkY/4w3n4o38WL/u6IDUIcK1ZLghhFeI0b14SVjK6JqjLIQt5EjTZo/g0DyZAla942uVlzU9bRuAxsEXSwbrwCZF9el+0mRzuKhETFeGQHA2s5Qg17I60k7SRoq6uCfv9JGSZzYq6GDYWwPwfyzrZl1Kvwjm+8iCOt7WRQRn3M0Lea5OaY79+Y+7Mqm+6uvJt+PiIECAwEAAaOCAdgwggHUMAwGA1UdEwEB/wQCMAAwHwYDVR0jBBgwFoAUiCcXCam2GGCL7Ou69kdZxVJUo7cwTQYDVR0fBEYwRDBCoECgPoY8aHR0cDovL2RldmVsb3Blci5hcHBsZS5jb20vY2VydGlmaWNhdGlvbmF1dGhvcml0eS93d2RyY2EuY3JsMA4GA1UdDwEB/wQEAwIHgDAdBgNVHQ4EFgQUdXYkomtiDJc0ofpOXggMIr9z774wggERBgNVHSAEggEIMIIBBDCCAQAGCiqGSIb3Y2QFBgEwgfEwgcMGCCsGAQUFBwICMIG2DIGzUmVsaWFuY2Ugb24gdGhpcyBjZXJ0aWZpY2F0ZSBieSBhbnkgcGFydHkgYXNzdW1lcyBhY2NlcHRhbmNlIG9mIHRoZSB0aGVuIGFwcGxpY2FibGUgc3RhbmRhcmQgdGVybXMgYW5kIGNvbmRpdGlvbnMgb2YgdXNlLCBjZXJ0aWZpY2F0ZSBwb2xpY3kgYW5kIGNlcnRpZmljYXRpb24gcHJhY3RpY2Ugc3RhdGVtZW50cy4wKQYIKwYBBQUHAgEWHWh0dHA6Ly93d3cuYXBwbGUuY29tL2FwcGxlY2EvMBAGCiqGSIb3Y2QGCwEEAgUAMA0GCSqGSIb3DQEBBQUAA4IBAQCgO/GHvGm0t4N8GfSfxAJk3wLJjjFzyxw+3CYHi/2e8+2+Q9aNYS3k8NwWcwHWNKNpGXcUv7lYx1LJhgB/bGyAl6mZheh485oSp344OGTzBMtf8vZB+wclywIhcfNEP9Die2H3QuOrv3ds3SxQnICExaVvWFl6RjFBaLsTNUVCpIz6EdVLFvIyNd4fvNKZXcjmAjJZkOiNyznfIdrDdvt6NhoWGphMhRvmK0UtL1kaLcaa1maSo9I2UlCAIE0zyLKa1lNisWBS8PX3fRBQ5BK/vXG+tIDHbcRvWzk10ee33oEgJ444XIKHOnNgxNbxHKCpZkR+zgwomyN/rOzmoDvdMIIEIzCCAwugAwIBAgIBGTANBgkqhkiG9w0BAQUFADBiMQswCQYDVQQGEwJVUzETMBEGA1UEChMKQXBwbGUgSW5jLjEmMCQGA1UECxMdQXBwbGUgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxFjAUBgNVBAMTDUFwcGxlIFJvb3QgQ0EwHhcNMDgwMjE0MTg1NjM1WhcNMTYwMjE0MTg1NjM1WjCBljELMAkGA1UEBhMCVVMxEzARBgNVBAoMCkFwcGxlIEluYy4xLDAqBgNVBAsMI0FwcGxlIFdvcmxkd2lkZSBEZXZlbG9wZXIgUmVsYXRpb25zMUQwQgYDVQQDDDtBcHBsZSBXb3JsZHdpZGUgRGV2ZWxvcGVyIFJlbGF0aW9ucyBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMo4VKbLVqrIJDlI6Yzu7F+4fyaRvDRTes58Y4Bhd2RepQcjtjn+UC0VVlhwLX7EbsFKhT4v8N6EGqFXya97GP9q+hUSSRUIGayq2yoy7ZZjaFIVPYyK7L9rGJXgA6wBfZcFZ84OhZU3au0Jtq5nzVFkn8Zc0bxXbmc1gHY2pIeBbjiP2CsVTnsl2Fq/ToPBjdKT1RpxtWCcnTNOVfkSWAyGuBYNweV3RY1QSLorLeSUheHoxJ3GaKWwo/xnfnC6AllLd0KRObn1zeFM78A7SIym5SFd/Wpqu6cWNWDS5q3zRinJ6MOL6XnAamFnFbLw/eVovGJfbs+Z3e8bY/6SZasCAwEAAaOBrjCBqzAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUiCcXCam2GGCL7Ou69kdZxVJUo7cwHwYDVR0jBBgwFoAUK9BpR5R2Cf70a40uQKb3R01/CF4wNgYDVR0fBC8wLTAroCmgJ4YlaHR0cDovL3d3dy5hcHBsZS5jb20vYXBwbGVjYS9yb290LmNybDAQBgoqhkiG92NkBgIBBAIFADANBgkqhkiG9w0BAQUFAAOCAQEA2jIAlsVUlNM7gjdmfS5o1cPGuMsmjEiQzxMkakaOY9Tw0BMG3djEwTcV8jMTOSYtzi5VQOMLA6/6EsLnDSG41YDPrCgvzi2zTq+GGQTG6VDdTClHECP8bLsbmGtIieFbnd5G2zWFNe8+0OJYSzj07XVaH1xwHVY5EuXhDRHkiSUGvdW0FY5e0FmXkOlLgeLfGK9EdB4ZoDpHzJEdOusjWv6lLZf3e7vWh0ZChetSPSayY6i0scqP9Mzis8hH4L+aWYP62phTKoL1fGUuldkzXfXtZcwxN8VaBOhr4eeIA0p1npsoy0pAiGVDdd3LOiUjxZ5X+C7O0qmSXnMuLyV1FTCCBLswggOjoAMCAQICAQIwDQYJKoZIhvcNAQEFBQAwYjELMAkGA1UEBhMCVVMxEzARBgNVBAoTCkFwcGxlIEluYy4xJjAkBgNVBAsTHUFwcGxlIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MRYwFAYDVQQDEw1BcHBsZSBSb290IENBMB4XDTA2MDQyNTIxNDAzNloXDTM1MDIwOTIxNDAzNlowYjELMAkGA1UEBhMCVVMxEzARBgNVBAoTCkFwcGxlIEluYy4xJjAkBgNVBAsTHUFwcGxlIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MRYwFAYDVQQDEw1BcHBsZSBSb290IENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA5JGpCR+R2x5HUOsF7V55hC3rNqJXTFXsixmJ3vlLbPUHqyIwAugYPvhQCdN/QaiY+dHKZpwkaxHQo7vkGyrDH5WeegykR4tb1BY3M8vED03OFGnRyRly9V0O1X9fm/IlA7pVj01dDfFkNSMVSxVZHbOU9/acns9QusFYUGePCLQg98usLCBvcLY/ATCMt0PPD5098ytJKBrI/s61uQ7ZXhzWyz21Oq30Dw4AkguxIRYudNU8DdtiFqujcZJHU1XBry9Bs/j743DN5qNMRX4fTGtQlkGJxHRiCxCDQYczioGxMFjsWgQyjGizjx3eZXP/Z15lvEnYdp8zFGWhd5TJLQIDAQABo4IBejCCAXYwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFCvQaUeUdgn+9GuNLkCm90dNfwheMB8GA1UdIwQYMBaAFCvQaUeUdgn+9GuNLkCm90dNfwheMIIBEQYDVR0gBIIBCDCCAQQwggEABgkqhkiG92NkBQEwgfIwKgYIKwYBBQUHAgEWHmh0dHBzOi8vd3d3LmFwcGxlLmNvbS9hcHBsZWNhLzCBwwYIKwYBBQUHAgIwgbYagbNSZWxpYW5jZSBvbiB0aGlzIGNlcnRpZmljYXRlIGJ5IGFueSBwYXJ0eSBhc3N1bWVzIGFjY2VwdGFuY2Ugb2YgdGhlIHRoZW4gYXBwbGljYWJsZSBzdGFuZGFyZCB0ZXJtcyBhbmQgY29uZGl0aW9ucyBvZiB1c2UsIGNlcnRpZmljYXRlIHBvbGljeSBhbmQgY2VydGlmaWNhdGlvbiBwcmFjdGljZSBzdGF0ZW1lbnRzLjANBgkqhkiG9w0BAQUFAAOCAQEAXDaZTC14t+2Mm9zzd5vydtJ3ME/BH4WDhRuZPUc38qmbQI4s1LGQEti+9HOb7tJkD8t5TzTYoj75eP9ryAfsfTmDi1Mg0zjEsb+aTwpr/yv8WacFCXwXQFYRHnTTt4sjO0ej1W8k4uvRt3DfD0XhJ8rxbXjt57UXF6jcfiI1yiXV2Q/Wa9SiJCMR96Gsj3OBYMYbWwkvkrL4REjwYDieFfU9JmcgijNq9w2Cz97roy/5U2pbZMBjM3f3OgcsVuvaDyEO2rpzGU+12TZ/wYdV2aeZuTJC+9jVcZ5+oVK3G72TQiQSKscPHbZNnF5jyEuAF1CqitXa5PzQCQc3sHV1ITGCAcswggHHAgEBMIGjMIGWMQswCQYDVQQGEwJVUzETMBEGA1UECgwKQXBwbGUgSW5jLjEsMCoGA1UECwwjQXBwbGUgV29ybGR3aWRlIERldmVsb3BlciBSZWxhdGlvbnMxRDBCBgNVBAMMO0FwcGxlIFdvcmxkd2lkZSBEZXZlbG9wZXIgUmVsYXRpb25zIENlcnRpZmljYXRpb24gQXV0aG9yaXR5AggYWUMhcnSc/DAJBgUrDgMCGgUAMA0GCSqGSIb3DQEBAQUABIIBAGDp7QPCFzo+Q6jqSoqrEnYd+2JKJ+FHsHjG/JHUS4P7PQISJ7ckRTsA+DGqf87KXF0c6+GMBnpJkpGFQoV6WLEgpM019B1ch+BBtol/WJr2JdZAlXbmzX6+tSx9Uc0lpGR232yx1mM2lgpkZZSNjAFNDeKsjFU9cTiB0dVxLX3teFFU50Nm4DuEqXYqUs4nQ8z9693kgdWKSUBuADB7lbEOqeODs9nS0rxEoQW4HCgto6Uy226AeLZns3NOMsAoR5cXf5hLhyg+mBo+leuNoMWzRFRMDbUQiwe0dsucS4IpdbSJmhAgv4ETCNupB4OzvIdRBNf3ySR+GZ5FDbM9T9Y=

在服务器上

$postData = json_encode(
            array('receipt-data' => $receipt));

//标准 cURL 发布并从 Apple Sandbox Server 获取

我已阅读有关此内容的所有示例和论坛帖子，但似乎无法使其正常工作。

我的最佳猜测是我的收据编码错误，但我尝试了所有格式选项，但总是得到 21002（在我的服务器上）。

这里有什么我遗漏的吗？基本上我正在尝试： 1. 将 NSData 回执作为字符串发送到服务器 2. 让我的服务器 ping Apple 服务器 3.处理有效或无效收据问题

看来我的第 1 步是错误的，但我不确定。使用 base64encode 发送收据数据我错了吗？

我需要在我的服务器上做些什么来保留格式吗？

非常感谢任何和所有建议。

更新：

这是我用来将它发送到服务器的代码（当前它在到达服务器后会在哈希码中剪掉 +）

for (NSString* k in _post)       
{            
    postDataStr = [NSString stringWithFormat:@"%@&%@=%@", postDataStr,k,_post[k]];      
}

_req = [NSMutableURLRequest requestWithURL:_url cachePolicy:nil timeoutInterval:15.0f];    
[_req setValue:@"application/x-www-form-urlencoded" forHTTPHeaderField:@"Content-Type"];    
[_req setHTTPMethod:@"POST"];    
[_req setHTTPBody:[postDataStr dataUsingEncoding:NSUTF8StringEncoding]];

回答：

在发送到服务器时，+ 已从我的字符串中删除。我没有进行正确的 URL 编码。我将 + 替换为 %2B，现在可以使用了

【问题讨论】：

您是否在服务器 2 上获得 NULL 值？
base64 字符串确实使其“成功”发送到服务器，并且与发送的内容相同。
请问，根据您的回答：您在哪里将 + 替换为 %2B 以及如何替换，谢谢
@majorl3oat，在将请求发送到服务器之前，您需要将 + 替换为 %2B。我还必须删除 '\n' 和 \r' 才能让它工作。 receiptDataString=[receiptDataString stringByReplacingOccurrencesOfString:@"+" withString:@"%2B"]; receiptDataString=[receiptDataString stringByReplacingOccurrencesOfString:@"\n" withString:@""]; receiptDataString=[receiptDataString stringByReplacingOccurrencesOfString:@"\r" withString:@""];
完美！结果我遇到了同样的问题，当我将 Base64 字符串发送到我的服务器时，+:es 被替换为空格。

标签： php ios7 in-app-purchase

【解决方案1】：

这是我用来将收据直接发送到 Apple 服务器的代码。

NSURL *receiptURL = [[NSBundle mainBundle] appStoreReceiptURL];
NSData *receiptData = [NSData dataWithContentsOfURL:receiptURL];
[self checkTransactionWithAppleUseProduction:productionWebsite andData:receiptData];
NSString *string64=[receiptData base64EncodedStringWithOptions:kNilOptions];
NSString *payload = [NSString stringWithFormat:@"{\"receipt-data\" : \"%@\"}",string64];
NSData *payloadData = [payload dataUsingEncoding:NSUTF8StringEncoding];
NSString *serverURL;
if(productionWebsite)serverURL= @"https://buy.itunes.apple.com/verifyReceipt"; 
if(!productionWebsite)serverURL=@"https://sandbox.itunes.apple.com/verifyReceipt";
NSMutableURLRequest *request = [NSMutableURLRequest requestWithURL:[NSURL URLWithString:serverURL]];
[request setHTTPMethod:@"POST"];
[request setHTTPBody:payloadData];
NSURLConnection *conn = [[NSURLConnection alloc] initWithRequest:request delegate:self];
[conn start];

【讨论】：

有趣的是，您将收据数据作为一个整体发送（我只发送了 base64 字符串并在服务器上制作了 json）。
我直接向/从buy.itunes.apple.com/verifyReceipt 发送/接收，而不是向服务器中介。
你怎么能做到这一点彼得，苹果严格地说“不可能直接在用户设备和 App Store 之间建立可信连接，因为你不控制该连接的任何一端。”

【解决方案2】：

很明显，您的服务器端出了点问题。我将您的收据数据插入我的服务器 API 并获得以下经过验证的收据。试试这个示例 PHP 服务器端代码iOS7 - receipts not validating at sandbox - error 21002 (java.lang.IllegalArgumentException)。

{
   "status":0,
   "environment":"Sandbox",
   "receipt":{
      "receipt_type":"ProductionSandbox",
      "adam_id":0,
      "bundle_id":"<<snip>>",
      "application_version":"0.6",
      "download_id":0,
      "request_date":"2014-03-23 17:38:03 Etc\/GMT",
      "request_date_ms":"1395596283823",
      "request_date_pst":"2014-03-23 10:38:03 America\/Los_Angeles",
      "in_app":[
         {
            "quantity":"1",
            "product_id":"Gems500",
            "transaction_id":"1000000105271988",
            "original_transaction_id":"1000000105271988",
            "purchase_date":"2014-03-21 19:45:08 Etc\/GMT",
            "purchase_date_ms":"1395431108000",
            "purchase_date_pst":"2014-03-21 12:45:08 America\/Los_Angeles",
            "original_purchase_date":"2014-03-21 15:13:47 Etc\/GMT",
            "original_purchase_date_ms":"1395414827000",
            "original_purchase_date_pst":"2014-03-21 08:13:47 America\/Los_Angeles",
            "is_trial_period":"false"
         },
         {
            "quantity":"1",
            "product_id":"Gems500",
            "transaction_id":"1000000105295974",
            "original_transaction_id":"1000000105295974",
            "purchase_date":"2014-03-21 19:45:08 Etc\/GMT",
            "purchase_date_ms":"1395431108000",
            "purchase_date_pst":"2014-03-21 12:45:08 America\/Los_Angeles",
            "original_purchase_date":"2014-03-21 19:45:08 Etc\/GMT",
            "original_purchase_date_ms":"1395431108000",
            "original_purchase_date_pst":"2014-03-21 12:45:08 America\/Los_Angeles",
            "is_trial_period":"false"
         }
      ]
   }
}

【讨论】：

谢谢我再看一遍！
这是我用来发送数据的代码。您是否可以看到任何问题，或者是否有一个示例说明您如何发送我可以看到的原始 base64 字符串？ for (NSString* k in _post) { postDataStr = [NSString stringWithFormat:@"%@&%@=%@", postDataStr,k,_post[k]]; } _req = [NSMutableURLRequest requestWithURL:_url cachePolicy:nil timeoutInterval:15.0f]; [_req setValue:@"application/x-www-form-urlencoded" forHTTPHeaderField:@"Content-Type"]; [_req setHTTPMethod:@"POST"]; [_req setHTTPBody:[postDataStr dataUsingEncoding:NSUTF8StringEncoding]];
我的代码不保存空格之间的 + 标记。我进行了字符串比较，无论出于何种原因，我的代码都删除了 + 标记！嗯..
请将您的代码放入您的问题中。那里很难读。
试试 $jsonData = trim($jsonData, "\x0");

【解决方案3】：

我对 iOS 代码了解不多。

不过，我确实对 PHP 了解很多。我假设您的服务器端代码比此处提供的 sn-p 更多？我不确定 json_encode 的用法？还有什么是 $receipt，什么使用 $postData？

【讨论】：