While implementing the in-app billing for Android application, I came across a problem.
Let me explain the scenario first
We have a content server (data server) which has the list of products.
When user selects one from the list, he can be able to purchase it.
The purchase logic runs perfectly after I put my credit card detail using my test account.
In returns I am getting a signed data in Android device.
My Question is
1. Should I have to verify the signed data in Android device and then send some information or the data to Content server, which in return sends the product (I think this may not be good since there is no flow at server side to verify that the request is valid or not or more precisely; that the signature data is generated by google market or not)?
2. If I have to verify the data at server side, how can I do this? Should I have to send it to Google market (if yes, using which web service or API)?
Please help me to rectify this.
Thanks in advance.
For your second question, hash (eg: MD5, SHA) the data and send the hash along with the data to the server. At the server, create a hash of the data and compare the hashes to verify them.