Google Play 应用内结算购买签名的服务器端验证失败 [英] Server side verification of Google Play in-app billing purchase signature failed

问题描述

我目前正在将 Google Play 应用内计费集成到我的 androidgame 项目中，我设置了一个 Node.js 服务器并计划向其发送 Google Play 购买响应的originalJson"和signature"值以供服务器使用侧面验证.

i'm currently integrating Google Play in-app billing to my androidgame project, i have a Node.js server set up and plan to send it the "originalJson" and "signature" value of the Google Play purchase response for server side verification.

然后我在我的 Node.js 服务器上进行了一些测试，首先这里是我购买的其中一个的originalJson"和signature"值(从客户端获取):

then i put up a bit of test on my Node.js server, first here are the "originalJson" and "signature" value of one of my purchase(fetched from the client side):

   originalJson:{"orderId":"GPA.1312-8694-0319-25069","packageName":"com.shihu.sm.testin","productId":"com.shihu.sm.testin.diamond","purchaseTime":1452598011176,"purchaseState":0,"developerPayload":"{"iabProductId":"com.shihu.sm.testin.diamond","gOrderId":"2cb77de1a2a94db18b6df84f8037ea5b","serverId":"6","productId":"202"}","purchaseToken":"bjoncdcebeclpklebmadidgb.AO-J1OyEbKLL0rhWQAc1hjdWyJPXHkAoHZTfZasqUuFWKWyAlnj-opiDLYILNRpnWgcblO8vV37fWf0kpeNMRZcgRT-fRxAO4P8VQPmU-TJakB-sCiRx8sUxL4nxnUBMnZdFWdpaIZDW5tP3Ck4aO57n1o66PwnjZw"}
   signature:JdfwMxprv7iMbI5YnVIWXLEAqiDhAQQva2IdfxtmhqBvLNU4Msi8sj31mnrVJfShxNmQI3zhlNUrCCaXdraFM0/y8O4PoZWYr+PFjCmlMovhG+ldeImEu7x52GLoQ7DsO8Yh4aLYmxemezFc1RjcSpq+l6Zzu9T6j3fHjLfQ060SEFapZITI/poxlFyvJX3bHhF9wGP54tL6pGjB/7fBEqTM1zHXUYeZyz+4akqV8oODlIWwMKhvN5tX/Zra9kh9hm0bnJT/1YWso3tLlT/WTK9nsP1l/lTnEXvgzq9QVSGbT/cpD7KSbR5N4i/NmPYAlCOvesW9OlRD05L8yytpBw==

然后我编写了以下代码，使用RSA-SHA1"算法和base64"签名编码进行验证:

then i wrote the following code to do the verification with "RSA-SHA1" algorithm and "base64" signature encoding:

    var crypto = require('crypto');

    console.log('start verification');

    var public_key = "-----BEGIN PUBLIC KEY-----" + "
" + 
    "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAg+VmzvTvb856ur/J+PWC" + "
" +
    "gFRhLYV/chAuWzUuqlIh5gnYz1RFOYymCWAKP3wguol8YSe/72zEqAvPutBU2XVj" + "
" + 
    "zx3sHT+GUInbKjgZHzxw0viPh//OfaooEvEFMz9C6J8ABwpGNQUpACmyw12ZKshP" + "
" +
    "HCJ6PZV+nsWry6PEZgnYCF7w5SDP4GY2tr3Q5D0iQwoALA40KYQfsKZ6pI5L8bDT" + "
" +
    "2MLTFoemg/npeARy9HYkbonPatBhWjp2flzBRcyQx7DyQ7csLvPl5AGHRT4h5RBq" + "
" + 
    "RlLj+DBgNDAdwvHGyfhbTz7fPsT6xn7qifxAN+2gQsemSVmhi15zECF/k5MtTiOF" + "
" +
    "owIDAQAB" + "
" + 
    "-----END PUBLIC KEY-----";

    verifier= crypto.createVerify("RSA-SHA1");
    originalJson = '{"orderId":"GPA.1312-8694-0319-25069","packageName":"com.shihu.sm.testin","productId":"com.shihu.sm.testin.diamond","purchaseTime":1452598011176,"purchaseState":0,"developerPayload":"{"iabProductId":"com.shihu.sm.testin.diamond","gOrderId":"2cb77de1a2a94db18b6df84f8037ea5b","serverId":"6","productId":"202"}","purchaseToken":"bjoncdcebeclpklebmadidgb.AO-J1OyEbKLL0rhWQAc1hjdWyJPXHkAoHZTfZasqUuFWKWyAlnj-opiDLYILNRpnWgcblO8vV37fWf0kpeNMRZcgRT-fRxAO4P8VQPmU-TJakB-sCiRx8sUxL4nxnUBMnZdFWdpaIZDW5tP3Ck4aO57n1o66PwnjZw"}';
    signature = 'JdfwMxprv7iMbI5YnVIWXLEAqiDhAQQva2IdfxtmhqBvLNU4Msi8sj31mnrVJfShxNmQI3zhlNUrCCaXdraFM0/y8O4PoZWYr+PFjCmlMovhG+ldeImEu7x52GLoQ7DsO8Yh4aLYmxemezFc1RjcSpq+l6Zzu9T6j3fHjLfQ060SEFapZITI/poxlFyvJX3bHhF9wGP54tL6pGjB/7fBEqTM1zHXUYeZyz+4akqV8oODlIWwMKhvN5tX/Zra9kh9hm0bnJT/1YWso3tLlT/WTK9nsP1l/lTnEXvgzq9QVSGbT/cpD7KSbR5N4i/NmPYAlCOvesW9OlRD05L8yytpBw=='

    verifier.update(originalJson);
    if(verifier.verify(public_key, signature, "base64"))
        console.log('verification succeeded');
    else
        console.log("verification failed");

中间的密钥字符串是来自 Google 控制台的 base64 编码公钥，每 64 个字符由 ' ' 分割.一开始我没有把它分成 64 个字符的块并且一直失败，错误说不能生成 pub key 对象，后来我在互联网上遵循了一些例子并通过了，但直到现在，我还没有'还没有成功的验证结果.

the key string in the middle is the base64 encoded public key from Google Console split by ' ' with every 64 characters. at the beginning i didn't split it into chunks of 64 characters and kept failing with error saying can't generate the pub key object, it was later i followed some examples on the internet and got passed that, but till now, i haven't got a successful verification result yet.

我参考了更多示例，我认为验证的RSA-SHA1"和base64"设置是正确的，那么我仍然缺少什么或做错了什么?

i have referenced some more examples, and i think the 'RSA-SHA1' and 'base64' settings for the verification are the correct ones, so what am i still missing or doing wrong?

谢谢

推荐答案

您的 originalJson 字符串似乎缺少一些必要的转义.

It seems that your originalJson string is missing some necessary escaping.

我已经成功地验证了签名并重新添加了转义:

I've managed to verify the signature with the escaping added back in:

var originalJson = '{"orderId":"GPA.1312-8694-0319-25069","packageName":"com.shihu.sm.testin","productId":"com.shihu.sm.testin.diamond","purchaseTime":1452598011176,"purchaseState":0,"developerPayload":"{\"iabProductId\":\"com.shihu.sm.testin.diamond\",\"gOrderId\":\"2cb77de1a2a94db18b6df84f8037ea5b\",\"serverId\":\"6\",\"productId\":\"202\"}","purchaseToken":"bjoncdcebeclpklebmadidgb.AO-J1OyEbKLL0rhWQAc1hjdWyJPXHkAoHZTfZasqUuFWKWyAlnj-opiDLYILNRpnWgcblO8vV37fWf0kpeNMRZcgRT-fRxAO4P8VQPmU-TJakB-sCiRx8sUxL4nxnUBMnZdFWdpaIZDW5tP3Ck4aO57n1o66PwnjZw"}';

注意 \ 的.否则字符串不同.

Pay attention to the \'s. The string is different otherwise.

这篇关于Google Play 应用内结算购买签名的服务器端验证失败的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！