Sometimes I get old/existing transactionId with non renewing subscriptions. What could be the cause of this? Anyone experienced this in the past?

With storeKit and non renewing subscriptions, I sometimes receive an old transactionId from Apple. I know this because I send receipts to my backend to validate with Apple. When the transactionId is extracted and I attempt to save, my backend service detects that the transactionId alreasy exists. Is this a normal behavior?


This is confusing because the app received the SKPaymentTransactionStatePurchased and I am guessing that in production, money would have been taken from the customer's account. The whole thing is really confusing because I have not been able to determine when it happens. I only randomly experience during development.

Up vote post of leksrej Down vote post of leksrej
666 views
Posted by
leksrej
Reply
Add a Comment

Replies

> I sometimes receive an old transactionId from Apple... I only randomly experience during development.


I believe what you are seeing is the result of every restoreCompletedTransaction or repurchase (for free). You have discovered a serious flaw in the security of IAP receipt verification using Apple servers that Apple has been ignoring for many years. I reported it as a bug twice and they closed it with no action. The receipt's value for transaction_id in the array of IAP receipts is not the transaction_id of the receipt in updatedTransactions (transaction.transactionIdentifier). That transactionIdentifier is unique. The one in the receipt itself seems to be the original_transaction_id. That means that there is no way of distinguishing a copied receipt (i.e. a hacked purchase) from a new receipt associated with a restoreCompletedTransactions or a repurchase (for free). To do that you would need to use the transaction.transactionIdentifier.


I decode on board using OpenSSL - that assures that the receipt is intended for the device and is not copied from another device.


(Apple - if you are listening, contact me to discuss.)

Posted by
PBK
Up vote reply of PBK Down vote reply of PBK
Add a Comment

Might want to file a bug and see what comes back - see this thread for what may be evidence this is long standing: https://forums.developer.apple.com/thread/44603


Good luck.

Posted by
KMT
Up vote reply of KMT Down vote reply of KMT
Add a Comment