Subscription remains active, if device date changes

[NikhilPawar86]

Hi JC,
First of all I want to thank you for the wonderful work.

I'm currently integrating JCSubscriptionManager in my project. I'm facing following issue while testing. If current I'm subscribed & changing device date to few date prior to current date, then I can access the subscription more, for number of days I have taken prior to current date.

As in isSubscriptionActive method following condition has been checked
if (expirationInterval.doubleValue > [[NSDate date] timeIntervalSince1970]) {
return YES;
} else {
[self setSubscriptionExpirationIntervalSince1970:nil];
return NO;
}

So, if [NSDate date] changes then subscription will remain activated, no matter even if actual subscription may have been expired.

[ykjchen]

Hi Nikhil,

Thanks for the message. Good point, I hadn’t thought of that before. Do you have any suggestions as to how to block users from infinitely subscribing by rolling back their clocks? What do you think about keeping a timestamp in the keychain with the most recent time, and checking that the system time is always later than that timestamp?

Joseph

On Apr 25, 2014, at 5:30 AM, Nikhil Pawar notifications@github.com wrote:

Hi JC,
First of all I want to thank you for the wonderful work.

I'm currently integrating JCSubscriptionManager in my project. I'm facing following issue while testing. If current I'm subscribed & changing device date to few date prior to current date, then I can access the subscription more, for number of days I have taken prior to current date.

As in isSubscriptionActive method following condition has been checked
if (expirationInterval.doubleValue > [[NSDate date] timeIntervalSince1970]) {
return YES;
} else {
[self setSubscriptionExpirationIntervalSince1970:nil];
return NO;
}

So, if [NSDate date] changes then subscription will remain activated, no matter even if actual subscription may have been expired.

—
Reply to this email directly or view it on GitHub.

[NikhilPawar86]

I think checking status will be a much better way...
Please check: MKSG-MugunthKumar/MKStoreKit#86

[kubatruhlar]

compare with nsdate fetched from server ... viz. gh project: NSDate-ServerDate