[android-developers] Re: In-app purchases made via promo codes return empty developer payload string

[Ragunathan Pattabiraman]

No developer payload when purchasing using promo code within app or through 
play store.

Developer payload is the main defence against fake purchases. (As suggested 
by Google guy@netomarin  here 
https://www.youtube.com/watch?v=tRpGcA4IM5Q)


Now that purchases using promo code do not return developer payload even if 
the purchase is initiated within app, there is no defence against fake 
purchases.


Developer payload should be returned irrespective of payment method (credit 
card or promo code). If the redeeming of promo code happens through play 
store, we could be asked to provide static developer payload through 
developer console. So it is easy for google play to provide developer 
payload in any scenario.


Google, Are you working on this critical issue?

On Wednesday, March 9, 2016 at 2:38:16 PM UTC+5:30, Jérémy R wrote:
>
> Hi all,
>
> We are several developers to experience issue with in-app purchases & 
> promotion: if the promotion is used inside the app instead of the standard 
> payment method, the returned developer payload is empty.
> A post has been opened on Stack Overflow: 
> http://stackoverflow.com/questions/34979420/in-app-purchases-made-via-promo-codes-return-empty-developer-payload-string
>
> I asked the Google Play Developer Support (googleplay-dev...@google.com 
> ) but the answer I received is globally "there is no bug".
>
> Moreover, as commented in a comment by user greywolf82, when you use the 
> promotion via the Google Play store, this purchase can't have a developer 
> payload so it may be a serious security flaw if we can't check the 
> developer payload validity.
>
> So, does anyone have a valid developer payload after using a promotion 
> code?
>  
>

-- 
You received this message because you are subscribed to the Google Groups 
"Android Developers" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to android-developers+unsubscr...@googlegroups.com.
To post to this group, send email to android-developers@googlegroups.com.
Visit this group at https://groups.google.com/group/android-developers.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/android-developers/a2dc7b6d-b405-4575-87e4-ea4583b1b6f8%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[android-developers] Re: In-app purchases made via promo codes return empty developer payload string

[Duma Smt]

Hello Everyone,

I too faced the same issue when using promocodes. Your post has given me 
some clarity. My purchase verification failed at validating 
developersPayload everytime if it is a promo code purchase. I have few 
questions on this. 

1. If it is a promo code purchase, Can't I receive "developerPayload"? [I 
think I got ans for this from your post. But I did not find official google 
statement on this. Please let me know if there is any offical info upon 
this]
2. If ans is NOT to the question (1), is there any way to differentiate if 
a purchase is happend as a "Normal" or "Promo code" purchase?
3. If ans is NOT to the question (2), shall I skip check for validating 
developerPayload for a purchase, If there is a way to differentiate?



On Wednesday, March 9, 2016 at 2:38:16 PM UTC+5:30, Jérémy R wrote:
>
> Hi all,
>
> We are several developers to experience issue with in-app purchases & 
> promotion: if the promotion is used inside the app instead of the standard 
> payment method, the returned developer payload is empty.
> A post has been opened on Stack Overflow: 
> http://stackoverflow.com/questions/34979420/in-app-purchases-made-via-promo-codes-return-empty-developer-payload-string
>
> I asked the Google Play Developer Support (googleplay-dev...@google.com 
> ) but the answer I received is globally "there is no bug".
>
> Moreover, as commented in a comment by user greywolf82, when you use the 
> promotion via the Google Play store, this purchase can't have a developer 
> payload so it may be a serious security flaw if we can't check the 
> developer payload validity.
>
> So, does anyone have a valid developer payload after using a promotion 
> code?
>  
>

-- 
You received this message because you are subscribed to the Google Groups 
"Android Developers" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to android-developers+unsubscr...@googlegroups.com.
To post to this group, send email to android-developers@googlegroups.com.
Visit this group at https://groups.google.com/group/android-developers.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/android-developers/b6afb1b1-4291-46f3-83a5-cc8a1a547d77%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[android-developers] Re: In-app purchases made via promo codes return empty developer payload string

[Lee Keng Lou]

We are facing the same issue here. so is there any solution on this?

On Wednesday, March 9, 2016 at 5:08:16 PM UTC+8, Jérémy R wrote:
>
> Hi all,
>
> We are several developers to experience issue with in-app purchases & 
> promotion: if the promotion is used inside the app instead of the standard 
> payment method, the returned developer payload is empty.
> A post has been opened on Stack Overflow: 
> http://stackoverflow.com/questions/34979420/in-app-purchases-made-via-promo-codes-return-empty-developer-payload-string
>
> I asked the Google Play Developer Support (googleplay-dev...@google.com 
> ) but the answer I received is globally "there is no bug".
>
> Moreover, as commented in a comment by user greywolf82, when you use the 
> promotion via the Google Play store, this purchase can't have a developer 
> payload so it may be a serious security flaw if we can't check the 
> developer payload validity.
>
> So, does anyone have a valid developer payload after using a promotion 
> code?
>  
>

-- 
You received this message because you are subscribed to the Google Groups 
"Android Developers" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to android-developers+unsubscr...@googlegroups.com.
To post to this group, send email to android-developers@googlegroups.com.
Visit this group at https://groups.google.com/group/android-developers.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/android-developers/6677dc81-632b-438e-9da4-94fa5732e378%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[android-developers] Re: In-app purchases made via promo codes return empty developer payload string

[Laszlo Modis]

Any of you having problems with empty orderId even when the promo code was 
used in Google Play application? My server side uses that orderId for 
something and it won't allow purchases via promo code.

-- 
You received this message because you are subscribed to the Google Groups 
"Android Developers" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to android-developers+unsubscr...@googlegroups.com.
To post to this group, send email to android-developers@googlegroups.com.
Visit this group at https://groups.google.com/group/android-developers.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/android-developers/e4ef7174-30e7-47f9-b7c9-d2c687dc1f9d%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[android-developers] Re: In-app purchases made via promo codes return empty developer payload string

[Jérémy R]

@Mattia Roccaforte: you're right concerning the onIabPurchaseFinished() and 
the following getPurchases() calls.
I was talking about the other case: when the purchase is done directly in 
the Play Store where there is no way to provide anything. So if Google only 
fixes the bug, verifying payload for an in-app purchases done directly on 
the Play Store will still fail.

On Saturday, March 12, 2016 at 7:14:46 PM UTC+1, Mattia Roccaforte wrote:
>
> The problem is we already pass a payload when sending the BuyIntent. It 
> gets lost on Google's side - it's empty in onIabPurchaseFinished() already -
> and the only proper solution imo is that they fix this loss.
>

-- 
You received this message because you are subscribed to the Google Groups 
"Android Developers" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to android-developers+unsubscr...@googlegroups.com.
To post to this group, send email to android-developers@googlegroups.com.
Visit this group at https://groups.google.com/group/android-developers.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/android-developers/772f0217-5222-4eff-b083-4b83c388f442%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[android-developers] Re: In-app purchases made via promo codes return empty developer payload string

[Mattia Roccaforte]

The problem is we already pass a payload when sending the BuyIntent. It 
gets lost on Google's side - it's empty in onIabPurchaseFinished() already -
and the only proper solution imo is that they fix this loss.

-- 
You received this message because you are subscribed to the Google Groups 
"Android Developers" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to android-developers+unsubscr...@googlegroups.com.
To post to this group, send email to android-developers@googlegroups.com.
Visit this group at https://groups.google.com/group/android-developers.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/android-developers/4c0c8d9a-e69a-41cd-8d0f-9c73f7afe376%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[android-developers] Re: In-app purchases made via promo codes return empty developer payload string

[Jérémy R]

Google may provide a way to declare our developer payload in the developer 
console with the associated promotion to cover this case. 

-- 
You received this message because you are subscribed to the Google Groups 
"Android Developers" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to android-developers+unsubscr...@googlegroups.com.
To post to this group, send email to android-developers@googlegroups.com.
Visit this group at https://groups.google.com/group/android-developers.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/android-developers/19cc5fb2-0755-44ce-869d-0143b7d2e3a4%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[android-developers] Re: In-app purchases made via promo codes return empty developer payload string

[vertical . ai . dev]

Same here. It is a loop hole, but I don't even know how Google can solve 
this...

On Wednesday, March 9, 2016 at 4:08:16 AM UTC-5, Jérémy R wrote:
>
> Hi all,
>
> We are several developers to experience issue with in-app purchases & 
> promotion: if the promotion is used inside the app instead of the standard 
> payment method, the returned developer payload is empty.
> A post has been opened on Stack Overflow: 
> http://stackoverflow.com/questions/34979420/in-app-purchases-made-via-promo-codes-return-empty-developer-payload-string
>
> I asked the Google Play Developer Support (googleplay-dev...@google.com 
> ) but the answer I received is globally "there is no bug".
>
> Moreover, as commented in a comment by user greywolf82, when you use the 
> promotion via the Google Play store, this purchase can't have a developer 
> payload so it may be a serious security flaw if we can't check the 
> developer payload validity.
>
> So, does anyone have a valid developer payload after using a promotion 
> code?
>  
>

-- 
You received this message because you are subscribed to the Google Groups 
"Android Developers" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to android-developers+unsubscr...@googlegroups.com.
To post to this group, send email to android-developers@googlegroups.com.
Visit this group at https://groups.google.com/group/android-developers.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/android-developers/a9da892d-41b9-43d6-8ae6-3cda565baa0e%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[android-developers] Re: In-app purchases made via promo codes return empty developer payload string

[Laszlo Modis]

I experience the same issue but orderId is also empty for purchases made 
with promo code.

-- 
You received this message because you are subscribed to the Google Groups 
"Android Developers" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to android-developers+unsubscr...@googlegroups.com.
To post to this group, send email to android-developers@googlegroups.com.
Visit this group at https://groups.google.com/group/android-developers.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/android-developers/7b586066-fd2c-499c-88b5-9375f8c8178a%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[android-developers] Re: In-app purchases made via promo codes return empty developer payload string

[Mattia Roccaforte]

Reporting the same problem. 
Using Play Services 8.4.0, IAB v3.

A purchase made with promo code via the in-app purchase flow, always 
returns an empty string as payload, preventing any kind of payload 
verification.

I consider this a high priority issue since there is no way as of now to 
know if a purchase has been made via promotion, so we are forced either not 
to distribute codes or to turn down payload verification completely.

-- 
You received this message because you are subscribed to the Google Groups 
"Android Developers" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to android-developers+unsubscr...@googlegroups.com.
To post to this group, send email to android-developers@googlegroups.com.
Visit this group at https://groups.google.com/group/android-developers.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/android-developers/c9b4153b-8f03-4aad-bfc7-b9f7851b%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.