title: Verifying in-app-purchases
body: <p>The <a href="https://github.com/googlesamples/android-play-billing/blob/master/TrivialDrive_v2/" rel="noreferrer">sample app</a> that <a href="https://developer.android.com/google/play/billing/billing_library" rel="noreferrer">the Google Developers guide</a> refers to has a method called <code>verifyValidSignature()</code> that looks like this in the <code>BillingManager</code> class:</p>
  
  <pre><code>/**
   * Verifies that the purchase was signed correctly for this developer's public key.
   *
   * Note: It's strongly recommended to perform such check on your backend since hackers can
   * replace this method with "constant true" if they decompile/rebuild your app.
   */
  private boolean verifyValidSignature(String signedData, String signature) {
      try {
          return Security.verifyPurchase(BASE_64_ENCODED_PUBLIC_KEY, signedData, signature);
      } catch (IOException e) {
          Log.e(TAG, "Got an exception trying to validate a purchase: " + e);
          return false;
      }
  }
  </code></pre>
  
  <p>What exactly do they mean by <em>"perform such check on your backend"</em> ? What backend?</p>
  
  <p>This method is called from this method (also in <code>BillingManager</code>):</p>
  
  <pre><code>private void handlePurchase(Purchase purchase) {
      if (!verifyValidSignature(purchase.getOriginalJson(), purchase.getSignature())) {
          Log.i(TAG, "Got a purchase: " + purchase + "; but signature is bad. Skipping...");
          return;
      }
  
      Log.d(TAG, "Got a verified purchase: " + purchase);
  
      mPurchases.add(purchase);
  }
  </code></pre>
  
  <p>I don't really understand what I'm supposed to do on said backend, that is to stop an attacker from simply removing </p>
  
  <pre><code>if (!verifyValidSignature(purchase.getOriginalJson(), purchase.getSignature())) {
      Log.i(TAG, "Got a purchase: " + purchase + "; but signature is bad. Skipping...");
      return;
  }
  </code></pre>
  
  <p>just as easily as replacing <code>verifyValidSignature()</code> <em>with "constant true"</em> as the JavaDoc for <code>verifyValidSignature()</code> warns. </p>
  
  <p>How would I stop an attacker from decompiling my app and replacing <em>something</em> to bypass my in-app-purchase check?</p>