Empfohlen
Weitere ähnliche Inhalte
Andere mochten auch
Ähnlich wie Android In-App Billing @ Barcelona GTUG
Ähnlich wie Android In-App Billing @ Barcelona GTUG (20)
Kürzlich hochgeladen
Kürzlich hochgeladen (20)
Android In-App Billing @ Barcelona GTUG
- 3. Android In-App Billing Demystified
- 4. Agenda • In-App Billing Overview • In-App Billing in Android • Android Market Billing Service • Android Billing Library • Administering & Testing In-App Billing • Security Best Practices
- 5. Freemium
- 10. IAB for the user... • Faster • Simpler • Contextual • “Harmless” • “Inexpensive”
- 11. IAB generates more sales
- 12. Agenda • In-App Billing Overview • In-App Billing in Android • Android Market Billing Service • Android Billing Library • Administering & Testing In-App Billing • Security Best Practices
- 13. Options • Android Market In-App Billing • PayPal Mobile Payments Library • Others • Any web payment processor • Custom implementation
- 14. Android Market IAB • Android Market only • 30% of the sale price • Android 1.6 upwards • Only digital goods
- 15. PayPal Mobile Payments • Starts at 2.9% of the sale price + transaction fee • Android 1.5 upwards • Physical goods allowed
- 16. Others • Paythru • Movend • Open Payments • And a long list of other dubious looking websites
- 17. “All fees received by Developers for Products distributed via the Market must be processed by the Market's Payment Processor.” http://www.android.com/us/developer-distribution-agreement.html
- 18. Agenda • In-App Billing Overview • In-App Billing in Android • Android Market Billing Service • Android Billing Library • Administering In-App Billing • Security Best Practices
- 19. Pre-requisites • Services • AIDL • BroadcastReceiver • PendingIntent
- 20. Overview app Android IAB Market requests Server
- 22. IAB requests • CHECK_BILLING_SUPPORTED • REQUEST_PURCHASE • GET_PURCHASE_INFORMATION • CONFIRM_NOTIFICATIONS • RESTORE_TRANSACTIONS
- 23. IAB requests • MarketBillingService interface defined in an Android Interface Definition Language file (IMarketBillingService.aidl) • IAB requests sent by single IPC method (sendBillingRequest()) of the interface • Request type and parameters are sent as a Bundle
- 24. Binding to MarketBillingService try { boolean bindResult = mContext.bindService( new Intent("com.android.vending.billing.MarketBillingService.BIND"), this, Context.BIND_AUTO_CREATE); if (bindResult) { Log.i(TAG, "Service bind successful."); } else { Log.e(TAG, "Could not bind to the MarketBillingService."); } } catch (SecurityException e) { Log.e(TAG, "Security exception: " + e); } public void onServiceConnected(ComponentName name, IBinder service) { Log.i(TAG, "MarketBillingService connected."); mService = IMarketBillingService.Stub.asInterface(service); }
- 25. Request bundle parameters • Shared • BILLING_REQUEST: request type • API_VERSION: 1 • PACKAGE_NAME: app package • Specific • ITEM_ID, NONCE, NOTIFY_ID, DEVELOPER_PAYLOAD
- 26. Request bundle protected Bundle makeRequestBundle(String method) { Bundle request = new Bundle(); request.putString(BILLING_REQUEST, method); request.putInt(API_VERSION, 1); request.putString(PACKAGE_NAME, getPackageName()); return request; }
- 27. Making a request Bundle request = makeRequestBundle("REQUEST_PURCHASE"); request.putString(ITEM_ID, mProductId); Bundle response = mService.sendBillingRequest(request);
- 28. IAB responses • The IAB service responds to every request with a synchronous response • Followed by 0..N asynchronous responses depending of the request type
- 29. Synchronous responses • RESPONSE_CODE: status information and error information about a request • REQUEST_ID: used to match asynchronous responses with requests • PURCHASE_INTENT: PendingIntent, which you use to launch the checkout activity. REQUEST_PURCHASE only.
- 30. Asynchronous responses • Broadcast intents: • RESPONSE_CODE • IN_APP_NOTIFY • PURCHASE_STATE_CHANGED
- 31. Receiving async responses public void onReceive(Context context, Intent intent) { String action = intent.getAction(); if (ACTION_PURCHASE_STATE_CHANGED.equals(action)) { String signedData = intent.getStringExtra(INAPP_SIGNED_DATA); String signature = intent.getStringExtra(INAPP_SIGNATURE); // Do something with the signedData and the signature. } else if (ACTION_NOTIFY.equals(action)) { String notifyId = intent.getStringExtra(NOTIFICATION_ID); // Do something with the notifyId. } else if (ACTION_RESPONSE_CODE.equals(action)) { long requestId = intent.getLongExtra(INAPP_REQUEST_ID, -1); int responseCodeIndex = intent.getIntExtra(INAPP_RESPONSE_CODE, ResponseCode.RESULT_ERROR.ordinal()); // Do something with the requestId and the responseCodeIndex. } else { Log.w(TAG, "unexpected action: " + action); } }
- 33. Check Billing Supported Parameters Basic Sync response keys RESPONSE_CODE RESULT_OK RESULT_BILLING_UNAVAILABLE Response codes RESULT_ERROR RESULT_DEVELOPER_ERROR Async response RESPONSE_CODE
- 34. Request Purchase
- 35. Request Purchase Basic Parameters ITEM_ID DEVELOPER_PAYLOAD RESPONSE_CODE Sync response keys PURCHASE_INTENT REQUEST_ID RESULT_OK Response codes RESULT_ERROR RESULT_DEVELOPER_ERROR RESPONSE_CODE Async response IN_APP_NOTIFY
- 36. Get Purchase Information Basic Parameters NONCE NOTIFY_IDS RESPONSE_CODE Sync response keys REQUEST_ID RESULT_OK Response codes RESULT_ERROR RESULT_DEVELOPER_ERROR RESPONSE_CODE Async response PURCHASE_STATE_CHANGED
- 37. Purchase State Changed JSON { "nonce" : 1836535032137741465, "orders" : { "notificationId" : "android.test.purchased", "orderId" : "transactionId.android.test.purchased", "packageName" : "com.example.dungeons", "productId" : "android.test.purchased", "developerPayload" : "bGoa+V7g/yqDXvKRqq+JTFn4uQZbPiQ", "purchaseTime" : 1290114783411, "purchaseState" : 0 } }
- 38. Purchase States • Purchased (0) • Canceled (1) • Refunded (2)
- 39. Confirm Notifications Basic Parameters NONCE NOTIFY_IDS RESPONSE_CODE Sync response keys REQUEST_ID RESULT_OK Response codes RESULT_ERROR RESULT_DEVELOPER_ERROR Async response RESPONSE_CODE
- 40. Unsolicited In-App Notify • Purchase when app is running in various devices • Refunds
- 41. Unsolicited In-App Notify
- 43. Restore Transactions Basic Parameters NONCE RESPONSE_CODE Sync response keys REQUEST_ID RESULT_OK Response codes RESULT_ERROR RESULT_DEVELOPER_ERROR RESPONSE_CODE Async response PURCHASE_STATE_CHANGED
- 44. Security Controls • Signed purchase data • In-App Notify Nonces
- 45. Purchase State Changed Extras • inapp_signed_data: Signed JSON string (unencrypted) • inapp_signature: Use the Android Market public key to validate
- 48. Agenda • In-App Billing Overview • In-App Billing in Android • Android Market Billing Service • Android Billing Library • Administering & Testing In-App Billing • Security Best Practices
- 50. Android Billing Library • https://github.com/robotmedia/ AndroidBillingLibrary • Beta but... • “Better than starting from scratch”
- 51. Features • Full Android IAB Service implementation • Auto-confirmations • Obfuscated purchases database • Implements security best-practices • Half-decent unit testing coverage
- 52. Overview
- 53. AndroidManifest.xml <!-- Add this permission to your manifest --> <uses-permission android:name="com.android.vending.BILLING" /> <application> <!-- Add this service and receiver to your application --> <service android:name="net.robotmedia.billing.BillingService" /> <receiver android:name="net.robotmedia.billing.BillingReceiver"> <intent-filter> <action android:name="com.android.vending.billing.IN_APP_NOTIFY" /> <action android:name="com.android.vending.billing.RESPONSE_CODE" /> <action android:name="com.android.vending.billing.PURCHASE_STATE_CHANGED" /> </intent-filter> </receiver> </application>
- 54. Set Configuration public void onCreate() { super.onCreate(); BillingController.setDebug(true); BillingController.setConfiguration(new BillingController.IConfiguration() { @Override public byte[] getObfuscationSalt() { return new byte[] {41, -90, -116, -41, 66, -53, 122, -110, -127, -96, -88, 77, 127 } @Override public String getPublicKey() { return "your public key here"; } }); }
- 55. Check Billing Supported @Override public void onCreate(Bundle savedInstanceState) { // ... BillingController.registerObserver(mBillingObserver); BillingController.checkBillingSupported(this); // ... } public void onBillingChecked(boolean supported) { if (!supported) { showDialog(DIALOG_BILLING_NOT_SUPPORTED_ID); } }
- 56. Request Purchase BillingController.requestPurchase(this, productId, true /*confirm*/); @Override public void onPurchaseIntent(String itemId, PendingIntent purchaseIntent) { BillingController.startPurchaseIntent(activity, purchaseIntent, null); } @Override public void onRequestPurchaseResponse(String itemId, ResponseCode response) { } @Override public void onPurchaseStateChanged(String itemId, PurchaseState state) { }
- 57. Restore Transactions if (!mBillingObserver.isTransactionsRestored()) { BillingController.restoreTransactions(this); Toast.makeText(this, R.string.restoring_transactions, Toast.LENGTH_LONG).show(); } @Override public void onTransactionsRestored() { final SharedPreferences preferences = PreferenceManager.getDefaultSharedPreferences(activity); final Editor editor = preferences.edit(); editor.putBoolean(KEY_TRANSACTIONS_RESTORED, true); editor.commit(); }
- 59. Agenda • In-App Billing Overview • In-App Billing in Android • Android Market Billing Service • Android Billing Library • Administering & Testing In-App Billing • Security Best Practices
- 60. Purchase type • Managed per user account • premium, digital content, unique virtual goods • Unmanaged • subscriptions, virtual currency, unlimited virtual goods
- 61. Managing In-App Products
- 63. Public key
- 64. Reserved product ids • android.test.purchased • android.test.canceled • android.test.refunded • android.test.item_unavailable
- 66. Signed test responses Application ever Draft uploaded & User been published? unpublished? * * Developer Yes No Test user Yes Yes *
- 67. Agenda • In-App Billing Overview • In-App Billing in Android • Android Market Billing Service • Android Billing Library • Administering & Testing In-App Billing • Security Best Practices
- 68. Best practices • Random nonces • Obfuscate purchase data • Embedding public key • Code obfuscation • Server-side signature validation
- 69. Gracias!
Hinweis der Redaktion
- \n
- \n
- \n
- \n
- \n
- \n
- \n
- \n
- \n
- \n
- \n
- \n
- \n
- \n
- \n
- \n
- \n
- \n
- \n
- \n
- \n
- \n
- \n
- \n
- \n
- \n
- \n
- \n
- \n
- \n
- \n
- \n
- \n
- \n
- \n
- \n
- \n
- \n
- \n
- \n
- \n
- \n
- \n
- \n
- \n
- \n
- \n
- \n
- \n
- \n
- \n
- \n
- \n
- \n
- \n
- \n
- \n
- \n
- \n
- \n
- \n
- \n
- \n
- \n
- \n
- \n
- \n
- \n
- \n
- \n