4

I use Google LVL and Google Inapp Billing API ver 3 in my java application for Android. Of course I use (slightly modified) LVL library project from Google extras and IAP jar that Google suggests.

LVL library LicenseValidator in verifyLicense receives ResponseData with user-id in it. It is said in Google docs that it is an unique user ID, representing user's google account used for purchase. So I assumed (and made sure in tests) it is the same string (for example, "ANlOH<...>ppA==") on all devices where user has logged in with the same Google account.

So here is my iap purchase protection scheme in short.

Before the purchase app sends user-id to my server. It generates an encrypted payload from user-id and sends it back. App makes a purchase request and puts payload in it. App receives a receipt signed by Google, that holds the same payload. App sends this receipt to my server with the current user-id. Server makes signature and other checks, compares user-ids from payload and from sender and if everything is fine sends files of iap item to the app.

In another scenario, when the user reinstalls the app to this or another device, app gets receipts belonging to him from InAppBilling, sends them to my server with the current user-id. Server performs the same checks and - if everything is fine - sends all needed files to the app.

This approach with small differences works well on other platforms. But I have experiencing some strange glitches recently on Android app. My server logs receipt check issues and I have found strange errors: user with one user-id sent correctly signed receipts belonging to another user-id (payload in receipt holds that another user-id). When I started to investigate I've found that one of such strange "hacker attack" messages belongs to one of my test devices while other belong to real users (according to order-ids in receipts).

This test device with Android 4.4.2 has several google accounts added in Settings. Previously I was sure that Google uses the first account. I saw such log messages:

InAppBillingUtils.getPreferredAccount: com.mypackage.appname: Account from first account - [jbC...FgH]

But now I see that sometimes LVL uses not the first account, but another one. I see such messages in LogCat:

InAppBillingUtils.pickAccount: smpxg.mythdefdf: Account determined from library ownership - [boL...M5E]

Moreover, after fresh installation of my app InAppBilling returned receipts for one account, but LVL gave user-id of another! But this behaviour is not stable. For example, now I see that LVL and InAppBilling both think that second account is my primary and work with it as expected.

I assumed that both libraries will work side by side but it looks like I was wrong. Obviously when the app sends receipt belonging to user-id "...yUQ" along with current use-id "...ppA" to server it refuses to send purchased content. And he is right.

If user could change current account used for purchases, I'd just added this trick in FAQ. BUT I can't see a way to select it manually in settings. In addition, system somehow selects it in a random way! The only way to make things work is to ask a user to delete all accounts from the device except his primary, but it's a bad solution.

When user purchases iap item being logged into one account and then switches to another account he should expect not to see purchased item. It's a predictable behaviour, just like with purchasing apps. But he doesn't even know what account is used in the moment!

AFAIK, there's not way to get from InAppBilling service google user-id it selected for purchases. But even if I could - having user-id changed randomly by system makes iap items to appear and disappear from time to time :)

Looks like Google advises to use developer payload for protection, but doesn't give any stable ID which can be used to identify particular account.

So my questions are:

  1. Does anybody experience this strange account switching?
  2. How can I be sure which account is current?
  3. Is there any way to synchronize LVL and InAppBilling account selection? Any workarounds?

Thank you in advance!

Tertium
  • 6,049
  • 3
  • 30
  • 51
  • i got same error on log and In-app purchase Dialog cannot pop up. have you got any answer? – Rahul Mandaliya Nov 17 '16 at 11:42
  • I had this problem but in other way. I'm saving purchased status on server side but each purchase is related with an user account. So if the user changes the account and tries to buy a one-time item he gets "You already have this item". I must to consume all items to prevent this scenario, I didn't want to because but as I cannot select which google account use to buy I have no other alternative – Gonzalo Dec 12 '21 at 17:36

1 Answers1

0

I havent had an exact experience with your issue, but this might be somewhat relevant

According to the In app billing documentation

If the device has more than one account, the purchase will be made with the account that downloaded the app. If none of the accounts has downloaded the app, the purchase is made with the first account.Users can confirm the account that is making a purchase by expanding the purchase dialog.

Val
  • 930
  • 6
  • 10