Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add JWS Validation #7

Merged
merged 5 commits into from
Nov 22, 2024
Merged

Add JWS Validation #7

merged 5 commits into from
Nov 22, 2024

Conversation

Lgdev07
Copy link
Contributor

@Lgdev07 Lgdev07 commented Aug 13, 2024

This pull request introduces the JWSValidation module, which is designed to validate JSON Web Signatures (JWS) received from Apple's App Store.

We've created a similar implementation and wanted to make it publicly available for use.

The idea of this module is to receive a string with the jws, and do the following:

  • decode the JWS to get its header
  • The header should have a "x5c" key with 3 certificates.
  • We validate the chain certificate with the public root one available here https://www.apple.com/certificateauthority/
  • Check if the X509 key inside the leaf certificate was really used to sign the payload

This is a validation for the JWS that Apple returns in some endpoints, it was tested in Get Transaction Info and Get Transaction History

Please take a look at the implementation and let me know if you have any questions.

@Lgdev07 Lgdev07 requested a review from linjunpop November 20, 2024 11:02
@linjunpop linjunpop merged commit 8326679 into linjunpop:main Nov 22, 2024
9 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants