Will the use of *uniqueIdentifier* rejected by app review? about cargobay HOT 2 CLOSED

Hi @smilingpoplar,

The solution for receipt validation in CargoBay is more or less the same as the solution Apple provided in In-App Purchase Receipt Validation on iOS.

Every transactionReceipt is tied to the device and in its data contains the device unique identifier (for iOS 5 and below) and unique identifier for vendor (for iOS 6 and above). The needs to validate against the unique identifier/unique identifier for vendor is to prevent a valid transactionReceipt that is meant for another device from passing the verification. Its kinda an important security check.

In Apple's solution, they did the same things as well. In fact, they also provides 2 private API below:

extern CFStringRef kSecTrustInfoExtendedValidationKey;
extern CFDictionaryRef SecTrustCopyInfo(SecTrustRef trust);

In the link, they mentioned

Note: This listing uses the symbols kSecTrustInfoExtendedValidationKey and SecTrustCopyInfo, which are not public API. Your app is allowed to use them for this specific purpose.

If Apple reviewing team asked, let them know that it is for receipt validation use only. Link them to this project and the link above. I strongly believe it shouldn't cause your project to be rejected.

Let me know if you face any problem, will be gladly to help you out promptly.

from cargobay.

@lxcid Thanks for the explanation.

from cargobay.