PHP handles the secondary verification on the server after in-app purchases in Apple APP (project experience)

The content of this article is about the PHP project integrating WeChat code scanning payment API (domestic payment). It has a certain reference value. Now I share it with you. Friends in need can refer to it

1. Apple APP payment to server verification process

1. The user clicks to purchase in the app;

2. The app calls the server interface to generate an order；

3. The payment window pops up after the app obtains the server order and successfully generates it;

4. The user enters the password to pay;

5. After the app receives the payment, the apple application The payment voucher returned by the store;

6. The app transmits the payment voucher back to the server and calls the server interface to verify whether the voucher is valid;

7. The app obtains the server-side verification result , feedback the user’s payment result status.

Instructions: For products paid by Apple, you need to configure the APP in-app purchase item in itunes Connect first. After configuration, a product ID will be generated correspondingly. On the Apple APP side When calling Apple Pay, you need to send the product ID (product_id) parameter to the Apple store. Then the payment process is carried out in the Apple Store. After the payment is completed, a payment voucher is returned to the APP, indicating that the payment is completed, but generally it will call its own server (merchant server) again for payment verification. At this time, write a verification interface on the server , determine whether the voucher is valid, and if valid, modify the order status and purchased product status accordingly, etc.

2. Credential verification function

        /**
	 * 验证AppStore内付
	 * @param  string $receipt_data 付款后凭证
	 * @return array                验证是否成功
	 */
	function validate_apple_pay($receipt_data)
	{
	    /**
	     * 21000 App Store不能读取你提供的JSON对象
	     * 21002 receipt-data域的数据有问题
	     * 21003 receipt无法通过验证
	     * 21004 提供的shared secret不匹配你账号中的shared secret
	     * 21005 receipt服务器当前不可用
	     * 21006 receipt合法，但是订阅已过期。服务器接收到这个状态码时，receipt数据仍然会解码并一起发送
	     * 21007 receipt是Sandbox receipt，但却发送至生产系统的验证服务
	     * 21008 receipt是生产receipt，但却发送至Sandbox环境的验证服务
	     */
	    function acurl($receipt_data, $sandbox=0){
	        //小票信息
	        $secret = "XXXXXXXXXXXXXXXXXXXX";    // APP固定密钥，在itunes中获取
	        $POSTFIELDS = array("receipt-data" => $receipt_data,'password'=>$secret);
	        $POSTFIELDS = json_encode($POSTFIELDS);
	 
	        //正式购买地址 沙盒购买地址
	        $url_buy     = "https://buy.itunes.apple.com/verifyReceipt";
	        $url_sandbox = "https://sandbox.itunes.apple.com/verifyReceipt";
	        $url = $sandbox ? $url_sandbox : $url_buy;
	 
	        //简单的curl
	        $ch = curl_init($url);
	        curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
	        curl_setopt($ch, CURLOPT_POST, 1);
	        curl_setopt($ch, CURLOPT_POSTFIELDS, $POSTFIELDS);
	        $result = curl_exec($ch);
	        curl_close($ch);
	        return $result;
	    }

	    // 验证参数
	    if (strlen($receipt_data)<20){
	        $result=array(
	            &#39;status&#39;=>false,
	            &#39;message&#39;=>&#39;非法参数&#39;
	            );
	        return $result;
	    }
	    // 请求验证
	    $html = acurl($receipt_data);
	    $data = json_decode($html,true);
	 
	    // 如果是沙盒数据 则验证沙盒模式
	    if($data[&#39;status&#39;]==&#39;21007&#39;){
	        // 请求验证
	        $html = acurl($receipt_data, 1);
	        $data = json_decode($html,true);
	        $data[&#39;sandbox&#39;] = &#39;1&#39;;
	    }
	 
	    if (isset($_GET[&#39;debug&#39;])) {
	        exit(json_encode($data));
	    }
	     
	    // 判断是否购买成功
	    if(intval($data[&#39;status&#39;])===0){
	        $result=array(
	            &#39;status&#39;=>true,
	            &#39;message&#39;=>&#39;购买成功&#39;
	            );
	    }else{
	        $result=array(
	            &#39;status&#39;=>false,
	            &#39;message&#39;=>&#39;购买失败 status:&#39;.$data[&#39;status&#39;]
	            );
	    }
	    return $result;
	}

Note: There is a key in the verification function that needs to be obtained from itunes.

3. Application demonstration (ThinkPHP3.2 controller)

    public function verify()
    {
    	// 获取订单号
    	$order_no = I('post.order_no');
    	// 获取用户id
    	$user_id  = I('post.uid');
    	//苹果内购的验证收据
        $apple_receipt = I('post.apple_receipt');
        // 判断是否缺少参数
    	if ( empty($order_no) || empty($user_id) || empty($apple_receipt) ) {
    	    $message = "缺少请求参数";
    	    $status = "400";
    	} else {
    	    // 代码思路
            // 1. 判断订单是否存在并且有效
            // 2. 判断用户是否存在
            // 3. 调用苹果支付凭证验证函数

            $verify_result = validate_apple_pay($apple_receipt);

            // 4.判断验证结果

            if( $apple_result['status'] ) {     // 凭证验证成功

                // 其他code,修改订单状态、购买商品状态……

                $message = "ok";
                $status  = "200";
            } else {                            // 凭证验证失败
                $status  = "401";
                $message = "验证失败";
            }
    	}
        // 返回接口数据
        $result = array();
        if( !empty($apple_receipt) ) {
        	$result['verify_result'] = $verify_result['message'];
        	$result['apple_receipt'] = $apple_receipt;
        }
        $result['status']  = $status;
        $result['message'] = $message;
        
        $this->response($result,'json');  //以json方式返回数据
    }

4. Reference documents

1. HTTP standard Status code;

2. Apple in-app purchase project configuration process;

3. iOS in-app payment (IAP) detailed explanation

Related recommendations:

PHP handles WeChat SDK intercepted photo uploads

The above is the detailed content of PHP handles the secondary verification on the server after in-app purchases in Apple APP (project experience). For more information, please follow other related articles on the PHP Chinese website!