Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: Recommend not using email address in payload string

Browse Source 
See first comment for doc stage location.

bug: 26492391
Change-Id: I72c159f1a7b71ff67c0d2c5b634dcc72d9150e6a
This commit is contained in:
Andrew Solovay
2016-01-27 12:58:52 -08:00
parent b3631e96b6
commit 74916a5682
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
docs/html/google/play/billing/billing_best_practices.jd
View File

@@ -100,6 +100,12 @@ Google Play returns this string together with the purchase details.</p>
made the purchase, so that you can later verify that this is a legitimate purchase by
that user. For consumable items, you can use a randomly generated string, but for non-
consumable items you should use a string that uniquely identifies the user.</p>
<p class="note">
<strong>Note:</strong> Do not use the user's
email address in the payload string, since that address may change.
</p>
<p>When you get back the response from Google Play, make sure to verify that the
developer payload string matches the token that you sent previously with the purchase
request. As a further security precaution, you should perform the verification on your