In App Purchase Receipt verification within app

I want to verify the transaction receipt within my app,

Here is my code,

- (void)recordTransaction:(SKPaymentTransaction *)transaction {

    NSData *receiptData = [NSData dataWithData:transaction.transactionReceipt];

    NSString *encodedString = [Base64 encode:receiptData];

     NSURL *url = [NSURL URLWithString:@"https://sandbox.itunes.apple.com/verifyReceipt"];

    ASIFormDataRequest *request = [[ASIFormDataRequest alloc] initWithURL:url];

    [request setPostValue:encodedString forKey:@"receipt-data"];

    [request setRequestMethod:@"POST"];

    [request setDelegate:self];

    [request startAsynchronous];

}

I am getting output:

{"status":21002, "exception":"java.lang.NullPointerException"}

Can someone help me to get proper re开发者_高级运维ceipt verification?

---

Just for those who may find it helpful. I noticed that apple has updated the In App Purchasing Guide with some status code that are for the auto renewable subscription purchases but seem to apply here as well.

• 21000 The App Store could not read the JSON object you provided.
• 21002 The data in the receipt-data property was malformed.
• 21003 The receipt could not be authenticated.
• 21004 The shared secret you provided does not match the shared secret on file for your account.
• 21005 The receipt server is not currently available.
• 21006 This receipt is valid but the subscription has expired. When this status code is returned to your server, the receipt data is also decoded and returned as part of the response.
• 21007 This receipt is a sandbox receipt, but it was sent to the production service for verification.
• 21008 This receipt is a production receipt, but it was sent to the sandbox service for verification.

Important: The non-zero status codes here apply only when recovering information about a auto-renewable subscription. Do not use these status codes when testing responses for other kinds of products. (Really?)

I hope this helps as a reference. I got nailed with 21007.

List of status codes on Apple's website: https://developer.apple.com/library/ios/releasenotes/General/ValidateAppStoreReceipt/Chapters/ValidateRemotely.html

---

After number of tries, I decided to do the receipt verification from server side. Actually this is the recommended way.

Here is my code,

-(void)recordTransaction:(SKPaymentTransaction *)transaction {   

NSString* receiptString = [[[NSString alloc] initWithData:transaction.transactionReceipt encoding:NSUTF8StringEncoding] autorelease];

// POST this string to your server

// I used ASIFormDataRequest 

}

// server side 

$url = 'https://sandbox.itunes.apple.com/verifyReceipt';

// encode the receipt data received from application

$purchase_encoded = base64_encode( $purchase_receipt );

//Create JSON

    $encodedData = json_encode( Array( 
        'receipt-data' => $purchase_encoded 
    ) );


// POST data

    //Open a Connection using POST method, as it is required to use POST method.
    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, $url);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_POST, true);
    curl_setopt($ch, CURLOPT_POSTFIELDS, $encodedData);
    $encodedResponse = curl_exec($ch);
    curl_close($ch);


  //Decode response data using json_decode method to get an object.

      $response = json_decode( $encodedResponse );


// check response

if ($response->{'status'} != 0)

    // Invalid receipt

else

   // valid reciept

I found help form,

http://gamesfromwithin.com/in-app-purchases-part-3

---

...you're not firing your request. So your response is null, because you haven't made the request yet!

Either add a [request startSynchronous] call (which is generally a bad idea, you should always run your network calls asynchronously), or better yet rewrite your code to support an asynchronous network call, and use [request startAsynchronous] instead.

I would suggest reviewing the ASI documentation if you need more information: http://allseeing-i.com/ASIHTTPRequest/How-to-use

---

From the following reference I understand that your application need to use separate server for "Verifying Store Receipts". I think for receipts verification we need to use a request from static ip.

thanks,

Reference