title: How can my server securely authenticate iPhone in-app purchase?
body: <p>Look at Apple's diagram for the <a href="http://developer.apple.com/iPhone/library/documentation/NetworkingInternet/Conceptual/StoreKitGuide/Overview%20of%20the%20Store%20Kit%20API/OverviewoftheStoreKitAPI.html#//apple_ref/doc/uid/TP40008267-CH100-SW14" rel="noreferrer">server purchase model</a>.</p>
  
  <p>In step #9, how can the server know that it is really talking with an iPhone that is entitled to the purchase, and that Eve is not performing a replay with a dishonestly obtained receipt?</p>
  
  <p>The receipt may be valid, but that doesn't prove that the sender is the entitled party.</p>
  
  <p>Is there any notion of a device certificate on the iPhone that can be used to sign the receipt?</p>
  
  <p>Is there any way to bind the receipt to the device, or bind the receipt to both the iTunes account and to the device, so the server can validate?</p>