How can I verify that server-to-server notification comes from Apple, and not from third-party malefactor?Maybe we could get some IP-ranges, from which Apple send notifications?Or maybe we should make request to AppStore to get info by receipt from notification, and compare it with json?Or maybe it possible to exchange keys? or use existed keys to verify source of request?Is there any best practices?Thank you.Anna
AnnaD
Users receive reputation points by contributing quality content to the forums.
Posts include post and replies published on the forums.
Post authors can mark replies as Accepted to indicate successful solutions.
Apple Developer Forums admins can mark replies as Apple Recommended to indicate an approved solution
Last seen
User for
Post
Replies
Boosts
Views
Activity
I have some questions about CANCEL notification.First of all, as i understand from documentation https://developer.apple.com/library/content/documentation/NetworkingInternet/Conceptual/StoreKitGuide/Chapters/Subscriptions.html,notification CANCEL comes to backend server only if user make refund from AppStore. Is it right? Or maybe there are other cases when it may come?Second question. If user made refund, and we got cancel notification, after few month he bought the same product as earlier. Which notification comes to server and App, with the same original_transaction_id as in previous (refunded) purchase, or it would be absolutly new purchase?