Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: Recommend not using email address in payload string

Browse Source 
See first comment for doc stage location.

bug: 26492391
Change-Id: I72c159f1a7b71ff67c0d2c5b634dcc72d9150e6a
This commit is contained in:
Andrew Solovay
2016-01-27 12:58:52 -08:00
parent b3631e96b6
commit 74916a5682
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
docs/html/google/play/billing/billing_best_practices.jd
View File

@@ -100,6 +100,12 @@ Google Play returns this string together with the purchase details.</p>
made the purchase, so that you can later verify that this is a legitimate purchase by made the purchase, so that you can later verify that this is a legitimate purchase by
that user. For consumable items, you can use a randomly generated string, but for non- that user. For consumable items, you can use a randomly generated string, but for non-
consumable items you should use a string that uniquely identifies the user.</p> consumable items you should use a string that uniquely identifies the user.</p>
<p class="note">
<strong>Note:</strong> Do not use the user's
email address in the payload string, since that address may change.
</p>
<p>When you get back the response from Google Play, make sure to verify that the <p>When you get back the response from Google Play, make sure to verify that the
developer payload string matches the token that you sent previously with the purchase developer payload string matches the token that you sent previously with the purchase
request. As a further security precaution, you should perform the verification on your request. As a further security precaution, you should perform the verification on your