4

How can I validate an in-app purchase JWS Representation from StoreKit2 on my backend in Node?

Its easy enough to decode the payload, but I can't find public keys that Apple uses to sign these JWS/JWTs anywhere. Any other time I've worked with JWTs, you simply used the node jsonwebtoken library and passed in the signers public key or shared secret key, either configured or fetched from a JWK.

I can easily decode the JWS using node-jose j.JWS.createVerify().verify(jwsString, {allowEmbeddedKey: true}).then(r => obj = r) which gives me an object like:

 {
  protected: [ 'alg', 'x5c' ],
  header: {
    alg: 'ES256',
    x5c: [
      'MIIEMDueU3...',
      'MII..., 
'MIICQzCCAcmgAwIBAgIILcX8iNLFS5UwCgYIKoZIzj0EAwMwZzEbMBkGA1UEAwwSQXBwbGUgUm9vdCBDQSAtIEczMSYwJAYDVQQLDB1BcHBsZSBDZXJ0aWZpY2F0...'  
    ]
  },
  payload: <Buffer 7b 22 74 72 61 6e 73 61 63 74 69 6f 6e 49 64 22 3a 22 31 30 30 30 30 30 30 38 38 36 39 31 32 38 39 30 22 2c 22 6f 72 69 67 69 6e 61 6c 54 72 61 6e 73 ... 420 more bytes>,
  signature: <Buffer f8 85 65 79 a1 dc 74 dd 90 80 0a a4 08 85 30 e7 22 80 4c 20 66 09 0b 84 fc f4 e5 57 53 da d5 6f 13 c6 8f 56 e8 29 67 5c 95 a6 27 33 47 1e fe e9 6e 41 ... 14 more bytes>,
  key: JWKBaseKeyObject {
    keystore: JWKStore {},
    length: 256,
    kty: 'EC',
    kid: 'Prod ECC Mac App Store and iTunes Store Receipt Signing',
    use: '',
    alg: ''
  }
}

And its easy to JSON.parse the payload and get the data I want. But, how can i verify that its authentic using the certificate chain in the x5c field

Thank you!

3 Answers 3

7

Finally figured this out. It turns out that we needed a "hardcoded" certificate to check against.

Apple has the certificates needed on their website. You have download the root certificate (since that's the one signing the entire chain), but you can also get the intermediate one.

Once you download one you convert it to .pem:

 $ openssl x509 -inform der -in apple_root.cer -out apple_root.pem

then all you need to do is verify them against the ones in the JWS (the following is in PHP, but you should get the gist):

if (openssl_x509_verify($jws_root_cert, $downloaded_apple_root_cert) == 1){
    //valid
}

Hope this helps everyone else!

5
  • This is it! Just needed that website. For the life of me could not find that site. Will code it up later to check.
    – max
    Nov 12, 2021 at 19:37
  • @Merricat I'm a bit confused. What is $jws_root_cert ? Where can I get it? Nov 24, 2021 at 10:49
  • @DaronTancharoen I'm referring to $jws_root_cert as the last certificate in the JWS's header x5c field (after decoding it). If you're having trouble, see my original post
    – Merricat
    Nov 25, 2021 at 16:49
  • Thank you for your answer. I have done it in Golang in this sample
    – zangw
    Jan 26 at 8:11
  • You are only validating the root certificate from the header. Now you need to validate the entire JWS
    – pableiros
    Jun 16 at 21:18
1

The JWS x5c header parameter contains the entire certificate chain used to sign and validate the JWS. There is no need to fetch any other certificates or keys.

The RFC specifies that the certificate corresponding to the public key that was used to sign the JWS must be the first certificate.

You can extract the public key from this certificate and use it to verify the JWS signature. There is some guidance on this in this answer

One of the great improvements in StoreKit2 is that you are no longer required to use a server to validate in app purchase transactions securely.

Apple's WWDC 2021 session on StoreKit2 describes the content of the JWS and also shows how to validate on device that the JWS was actually generated for that device.

But, what if you do want to validate the transaction on a server? Since the x5c claim contains the certificate chain, an attacker could sign a forged JWS with their own certificate and include that certificate in the x5c claim.

The answer is that you have your app send the original transaction id to your server along with any other information you need, such as the user's account identifier. Your server can then request the corresponding JWS from Apple and validate the signature of the returned JWS.

As the JWS was fetched from Apple by your server code it can be sure that it is not a spoofed JWS.

If possible, include an appAccountToken in your purchase request and either determine the expected token value based on the user's authentication to your server or (less effective) have your app supply the token when it supplies the original transaction id. You can then verify the token value in the JWS matches the expected value. This makes it harder for an attacker to replay some other purchase event.

18
  • 1
    What if someone send you a false Server To Server Notification (S2S) and sign the JWS with his own certificate? The chain would be valid and you would trust the content of this S2S. So I think there is a missing part in your explanation: you should know at least 1 of the certificates in the chain BEFORE validating the chain, otherwise anybody could send you forget receipts. And that's what Max is asking for: where do you get this certificate from Apple? Oct 9, 2021 at 8:49
  • This is why you actually get validation on the device now. With the old store kit you needed to perform validation on a server. With storekit2 the validation is performed before the transaction is delivered to your app and you don't really need t perform validation on a server.
    – Paulw11
    Oct 9, 2021 at 11:49
  • If you want to perform validation on your server then you should not send the signed transaction from the app to your server. You should send only the original transaction Id. You server can the request the transaction history JWS from Apple. Since the response came from Apple the x5c claim is trustworthy.
    – Paulw11
    Oct 9, 2021 at 12:06
  • I didn't understood things like that. I mean, it's only trustworthy if no one goes between you and Apple (for the same reasons I explained before). Oct 9, 2021 at 23:31
  • For an attacker to place themselves between your server and Apple would be quite an undertaking in itself. And then they would need to coordinate interception of traffic from your app to your server in order to capture the appAccountToken. And, in fact, the app account token doesn't even need to appear on the wire if the server can compute the same token that the app passed to apple during the purchase. And, of course, your server can validate the certificate presented by Apple's server when you request the JWS, preventing MITM.
    – Paulw11
    Oct 10, 2021 at 3:21
1

You need to validate the header and the payload with the sign like says in the WWDC videos:

https://developer.apple.com/videos/play/wwdc2022/10040/ https://developer.apple.com/videos/play/wwdc2021/10174/

enter image description here

But is more complicate than you think to do this if you don't have the knownledge about JWT because there is no documentation from Apple to do this, they only say to you "use your favorite cryptographic library to verify the data".

So after doing a lot of research, finally I found a solution using PHP 8.1 with Laravel.

First you need to install this library https://github.com/firebase/php-jwt:

composer require firebase/php-jwt

Then you need to implement the following method in order to validate the JWT from the transaction:

use Firebase\JWT\JWT;
use Firebase\JWT\Key;

...

public function validateJwt($jwt)
{
    $components = explode('.', $jwt);

    if (count($components) !== 3) {
        throw new \Exception('JWS string must contain 3 dot separated component.');
    }

    $header = base64_decode($components[0]);
    $headerJson = json_decode($header,true);

    $certificate = '-----BEGIN CERTIFICATE-----'.PHP_EOL;
    $certificate .= chunk_split($headerJson['x5c'][0],64,PHP_EOL);
    $certificate .= '-----END CERTIFICATE-----'.PHP_EOL;

    $cert_object = openssl_x509_read($certificate);
    $pkey_object = openssl_pkey_get_public($cert_object);
    $pkey_array = openssl_pkey_get_details($pkey_object);
    $publicKey = $pkey_array['key'];

    $jwsDecoded = JWT::decode($jwt, new Key($publicKey, $headerJson['alg']));

    // If the signature and the jws is invalid, it will thrown an exception
 
    // If the signature and the jws is valid, it will create the $decoded object

    // You can use the $decoded object as an array if you need:

    $transactionId = ((array) $jwsDecoded)['transactionId']; 
}

To call the function, you need to pass the jwt from the transaction:

$jwt = 'eyJhbGciOiJFUzI1NiIsIng1YyI6WyJNSUl...';
validateJwt($jwt);
2
  • 1
    Your code made my day, I can't understand how Apple has that trash documentation. Only one thing, with the v2 your way to access the transactionId is not the right way. You need to add something like this $decodedTransactionInfo = JWT::Decode($decoded->data->signedTransactionInfo, new Key($publicKey, $headerJson['alg'])); and then you will have access to the transactionId and the rest of the information Jun 28 at 17:40
  • 1
    And you should change the use to use Firebase\JWT\JWT; use Firebase\JWT\Key; Jun 28 at 17:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.