Validate Apple StoreKit2 in-app purchase receipt jwsRepresentation in backend (node ideally, but anything works)

Finally figured this out. It turns out that we needed a "hardcoded" certificate to check against.

Apple has the certificates needed on their website. You have download the root certificate (since that's the one signing the entire chain), but you can also get the intermediate one.

Once you download one you convert it to .pem:

 $ openssl x509 -inform der -in apple_root.cer -out apple_root.pem

then all you need to do is verify them against the ones in the JWS (the following is in PHP, but you should get the gist):

if (openssl_x509_verify($jws_root_cert, $downloaded_apple_root_cert) == 1){
    //valid
}

Hope this helps everyone else!

It is quite challenging to piece this together from all the information, but here's how to do this in NodeJS. Note that the latest Node supports built-in crypto, which makes it much much easier. Here's my code with the necessary comments.

const jwt = require('jsonwebtoken');
const fs = require('fs');
const {X509Certificate} = require('crypto');

async function decode(signedInfo) {

    // MARK: - Creating certs using Node's new build-in crypto
    function generateCertificate(cert) {
        // MARK: - A simple function just like the PHP's chunk_split, used in generating pem. 
        function chunk_split(body, chunklen, end) {
            chunklen = parseInt(chunklen, 10) || 76;
            end = end || '\n';
            if (chunklen < 1) {return false;}
            return body.match(new RegExp(".{0," + chunklen + "}", "g")).join(end);
        }
        return new X509Certificate(`-----BEGIN CERTIFICATE-----\n${chunk_split(cert,64,'\n')}-----END CERTIFICATE-----`);
    }

    // MARK: - Removing the begin/end lines and all new lines/returns from pem file for comparison
    function getPemContent(path) {
        return fs.readFileSync(path)
            .toString()
            .replace('-----BEGIN CERTIFICATE-----', '')
            .replace('-----END CERTIFICATE-----', '')
            .replace(/[\n\r]+/g, '');
    }



    // MARK: - The signed info are in three parts as specified by Apple
    const parts = signedInfo.split('.');
    if (parts.length !== 3) {
        console.log('The data structure is wrong! Check it! ');
        return null;
    }
    // MARK: - All the information needed for verification is in the header
    const header = JSON.parse(Buffer.from(parts[0], "base64").toString());

    // MARK: - The chained certificates
    const certificates = header.x5c.map(cert => generateCertificate(cert));
    const chainLength = certificates.length;

    // MARK: - Leaf certificate is the last one
    const leafCert = header.x5c[chainLength-1];
    // MARK: - Download .cer file at https://www.apple.com/certificateauthority/. Convert to pem file with this command line: openssl x509 -inform der -in AppleRootCA-G3.cer -out AppleRootCA-G3.pem
    const AppleRootCA = getPemContent('AppleRootCA-G3.pem');
    // MARK: - The leaf cert should be the same as the Apple root cert
    const isLeafCertValid = AppleRootCA === leafCert;
    if (!isLeafCertValid) {
        console.log('Leaf cert not valid! ');
        return null;
    }

    // MARK: If there are more than one certificates in the chain, we need to verify them one by one 
    if (chainLength > 1) {
        for (var i=0; i < chainLength - 1; i++) {
            const isCertValid = certificates[i].verify(certificates[i+1].publicKey);
            if (!isCertValid) {
                console.log(`Cert ${i} not valid! `);
                return null;
            }
        }
    }

    return jwt.decode(signedInfo);
}

Good luck!

You need to validate the header and the payload with the sign like says in the WWDC videos:

https://developer.apple.com/videos/play/wwdc2022/10040/ https://developer.apple.com/videos/play/wwdc2021/10174/

But is more complicate than you think to do this if you don't have the knownledge about JWT because there is no documentation from Apple to do this, they only say to you "use your favorite cryptographic library to verify the data".

So after doing a lot of research, finally I found a solution using PHP 8.1 with Laravel.

First you need to install this library https://github.com/firebase/php-jwt:

composer require firebase/php-jwt

Then you need to implement the following method in order to validate the JWT from the transaction:

use Firebase\JWT\JWT;
use Firebase\JWT\Key;

...

public function validateJwt($jwt)
{
    $components = explode('.', $jwt);

    if (count($components) !== 3) {
        throw new \Exception('JWS string must contain 3 dot separated component.');
    }

    $header = base64_decode($components[0]);
    $headerJson = json_decode($header,true);

    $this->validateAppleRootCA($headerJson);

    $jwsParsed = (array) $this->decodeCertificate($jwt, $headerJson, 0);

    for ($i = 1; $i < count($headerJson) - 1; $i++) {
        $this->decodeCertificate($jwt, $headerJson, $i);
    }

    // If the signature and the jws is invalid, it will thrown an exception

    // If the signature and the jws is valid, it will create the $decoded object

    // You can use the $decoded object as an array if you need:

    $transactionId = $jwsParsed['transactionId'];
}

private function validateAppleRootCA($headerJson)
{
    $lastIndex = array_key_last($headerJson['x5c']);
    $certificate = $this->getCertificate($headerJson, $lastIndex);

    //  As Oliver Zhang says in their NodeJS example, download the .cer file at https://www.apple.com/certificateauthority/. Convert to pem file with this command line: openssl x509 -inform der -in AppleRootCA-G3.cer -out AppleRootCA-G3.pem
    // In Laravel, this location is at storage/keys/AppleRootCA-G3.pem
    $appleRootCA = file_get_contents(storage_path('keys/AppleRootCA-G3.pem'));

    if ($certificate != $appleRootCA) {
        throw new \Exception('jws invalid');
    }
}

private function getCertificate($headerJson, $certificateIndex)
{
    $certificate = '-----BEGIN CERTIFICATE-----'.PHP_EOL;
    $certificate .= chunk_split($headerJson['x5c'][$certificateIndex],64,PHP_EOL);
    $certificate .= '-----END CERTIFICATE-----'.PHP_EOL;

    return $certificate;
}

private function decodeCertificate($jwt, $headerJson, $certificateIndex)
{
    $certificate = $this->getCertificate($headerJson, 0);

    $cert_object = openssl_x509_read($certificate);
    $pkey_object = openssl_pkey_get_public($cert_object);
    $pkey_array = openssl_pkey_get_details($pkey_object);
    $publicKey = $pkey_array['key'];
    $jwsParsed = null;

    try {
        $jwsDecoded = JWT::decode($jwt, new Key($publicKey, 'ES256'));
        $jwsParsed = (array) $jwsDecoded;
    } catch (SignatureInvalidException $e) {
        throw new \Exception('signature invalid');
    }

    return $jwsParsed;
}

To call the function, you need to pass the jwt from the transaction:

$jwt = 'eyJhbGciOiJFUzI1NiIsIng1YyI6WyJNSUl...';
validateJwt($jwt);

The JWS x5c header parameter contains the entire certificate chain used to sign and validate the JWS. There is no need to fetch any other certificates or keys.

The RFC specifies that the certificate corresponding to the public key that was used to sign the JWS must be the first certificate.

You can extract the public key from this certificate and use it to verify the JWS signature. There is some guidance on this in this answer

One of the great improvements in StoreKit2 is that you are no longer required to use a server to validate in app purchase transactions securely.

Apple's WWDC 2021 session on StoreKit2 describes the content of the JWS and also shows how to validate on device that the JWS was actually generated for that device.

But, what if you do want to validate the transaction on a server? Since the x5c claim contains the certificate chain, an attacker could sign a forged JWS with their own certificate and include that certificate in the x5c claim.

The answer is that you have your app send the original transaction id to your server along with any other information you need, such as the user's account identifier. Your server can then request the corresponding JWS from Apple and validate the signature of the returned JWS.

As the JWS was fetched from Apple by your server code it can be sure that it is not a spoofed JWS.

If possible, include an appAccountToken in your purchase request and either determine the expected token value based on the user's authentication to your server or (less effective) have your app supply the token when it supplies the original transaction id. You can then verify the token value in the JWS matches the expected value. This makes it harder for an attacker to replay some other purchase event.