java - 使用 PHP 对 Android Market 许可响应进行服务器端验证

Question

我正在构建一个服务器来测试我在 Android 市场上的所有应用内购买。但我认为我没有正确地从应用程序发送信息。我的服务器是用 PHP 构建的。

我的应用访问 url:

...&response={...json...}&signature={...signature...}

签名之前使用 URLEncoder.encode(signature,"UTF-8") 编码

我的服务器:

$response = $_GET["response"];
$signature = htmlspecialchars(urldecode($_GET["signature"]));

然后我执行验证过程。我认为问题出在我将参数从应用程序传递到服务器的方式上，因为如果我手动复制响应和签名并测试它们，验证函数会说它们是有效的。

网址:

...&response={"nonce":-871647007848398655,"orders":[{"orderId":"768142460571407","packageName":"net.xxx.aaa","productId":"net.xxx.mmf.flyboys","purchaseTime":1330090436000,"purchaseState":0,"developerPayload":"Flyboys"},{"orderId":"203523162686707","packageName":"net.xxx.aaa","productId":"net.xxx.mmf.16blocks","purchaseTime":1330511533000,"purchaseState":0,"developerPayload":"16 Blocks"},{"orderId":"328483664834399","packageName":"net.xxx.aaa","productId":"net.xxx.mmf.aceventura3","purchaseTime":1331037005000,"purchaseState":0,"developerPayload":"Ace Ventura 3"}]}&signature=EyT9IgZeq2OLRqCtabTIc5wOKARtdHUfCQAdkEqkGyi%2Bd1qQgcfxPnvIa9VMDQqwh8rxxGPOYQKuhaEuZUJzbSain8%2FN7p41euzb1n1%2FgZkgqXlQTDn076U2AXcp1ymBFZamrwETo0gkZi4q6PZV47oR7Rk28vPU5vjs%2Bl0TN0DdlzclHuH40CkZqD1ErSMMwWGTGR6bGnJlmmhgHC2KV7Ab63i0hdgkqk5MOtkOxhjS%2B4LG1YxmJIsxhJnOcmNI7n2VKUdtn%2B0CWxO5M8m0BcfpZ9Se3sR6ZtVli2rS1KSKQPL1Td9GWPhmG4nvzZFtKCqf9Le6Meudv6iFTSw5Hg%3D%3D

转储

回应

string '{"nonce":-871647007848398655,"orders":[{"orderId":"768142460571407","packageName":"net.xxx.aaa","productId":"net.xxx.mmf.flyboys","purchaseTime":1330090436000,"purchaseState":0,"developerPayload":"Flyboys"},{"orderId":"203523162686707","packageName":"net.xxx.aaa","productId":"net.xxx.mmf.16blocks","purchaseTime":1330511533000,"purchaseState":0,"developerPayload":"16 Blocks"},{"orderId":"328483664834399","packageName":"net.xxx.aaa","productId":"net.xxx'... (length=617)

签名

string 'EyT9IgZeq2OLRqCtabTIc5wOKARtdHUfCQAdkEqkGyi d1qQgcfxPnvIa9VMDQqwh8rxxGPOYQKuhaEuZUJzbSain8/N7p41euzb1n1/gZkgqXlQTDn076U2AXcp1ymBFZamrwETo0gkZi4q6PZV47oR7Rk28vPU5vjs l0TN0DdlzclHuH40CkZqD1ErSMMwWGTGR6bGnJlmmhgHC2KV7Ab63i0hdgkqk5MOtkOxhjS 4LG1YxmJIsxhJnOcmNI7n2VKUdtn 0CWxO5M8m0BcfpZ9Se3sR6ZtVli2rS1KSKQPL1Td9GWPhmG4nvzZFtKCqf9Le6Meudv6iFTSw5Hg==' (length=344)

Answer 1

当使用 URL Encode 时，php 会自动解码数据，所以如果你重新解码它会破坏某些东西，我以前遇到过这个问题

URL 编码是针对浏览器的，因此虽然 get 发送的字符串中的 & 之类的东西不会作为 GET 中的新参数

所以你的代码 htmlspecialchars(urldecode($_GET["signature"])); 应该是 htmlspecialchars($_GET["signature"]);

我知道评论已经回答了这个问题，但是为 Google 员工添加了答案