Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
This PR serves as ground work to a patch to security issue where this framework calls Apple's receipt validation endpoints directly which is susceptive to MITM attack whereby attacker can spoof the receipt validation.
This PR also enables framework users to inject their own custom receipt validator. There are 3 scenarios where this is useful:
Framework users who want to implement server-to-server receipt validation (their own backend - Apple's validation service)
Framework users who want to handle validation on their own backend
Client-side receipt validation implementation
Code related changes
ReceiptValidator
protocol. Custom receipt validator should conform to this protocolModified signature of
verifyReceipt
function to let user to inject custom receipt validator objectExtract existing validation code to
AppleReceiptValidator
that conforms toReceiptValidator
Updated examples to use
AppleReceiptValidator
, this should be served only for demonstration purpose, shouldn't use this validator for production code