How to authenticate Ios Server-to-Server Notifications

Question

When we configure Server-to-Server Notifications, we Specify our secure server's URL in App Store Connect and the apple server communicates on that URL. but is there a way to authenticate this request?

It is not safe to keep url open without authentication

in case of PlayStore we can use GOOGLE_DEVELOPER_API_KEYFILE_JSON for authentication, but how to do this for iOS server-server notification?

Outstretch

I really want to find out this as well. I did some research and so far it looks like there is no other way, other than whitelisting the Apple IP. Another option is when notification comes in, just make VerifyReceipt request back to Apple to verify it's actually from Apple. But not sure if this is the best thing to do. – Diagram

where can we find which IPs to whitelist? – Outstretch

A quick google search resuls are wq.apnic.net/apnic-bin/whois.pl?searchtext=17.21.2.14 en.wikipedia.org/wiki/List_of_assigned_/8_IPv4_address_blocks . which is 17.0.0.0/8 – Diagram

Answer 1

As the comments have already clarified that there is no built in way.

So, here is my work around of this problem.

Apple sends password in the notification which is App secret key which ideal should only be known by API and Apple.

And to verify receipts coming from the App this password must already be stored somewhere (configuration?) in the API.

So I suggest to check whether the password in request matches with the one stored in our API?

If yes then this is a valid request.

If not then it may be sent by a hacker.

My only concern is that does this App shared secret key aka password change? by Apple or developer? If not than this is the solution.

Panelboard

Answer 2

One way to do it is to use Basic auth. As you cannot specify a header you can use the url format: https://username:password@SERVER_ENDPOINT. This will automatically encode the username:password and construct a basic auth header with the encoded string.

Source: https://en.wikipedia.org/wiki/Basic_access_authentication

Sauerbraten

This is not a valid URL link for App Store Connect, but great idea anyway! – Sentimentality