[1.x] Unsupported Apple Server Notification URL

[leightonkuchel]

Liap version(s) affected

1.x

Description

We were using the 0.10.3 version of the library, and recently upgraded to 1.6.1 in December 2022. Since then, LIAP has stopped handling events from the Apple Server Notifications. After some investigation, it seems that the generated LIAP endpoint is no longer supported by Apple.

How to reproduce

1. Install the latest version of LIAP (or anything from 1.x)
2. Generate a standard (or signed) url for Apple as per the LIAP documentation. This will produce a route with the url /liap/notifications?provider=app-store.
3. Log into App Store Connect and set the Sandbox Server URL to the newly generated url as per the LIAP documentation (eg https://<your-site>/liap/notifications?provider=app-store)
4. Set up your server to support Test Notifications as per the LIAP documentation
5. Observe your server's access.log file to see incoming requests
6. Trigger a Sandbox Test Notification via php artisan liap:apple:test-notification --sandbox
7. Observe the access.log entry is not /liap/notifications*. For example:

17.58.63.214 - - [23/Jan/2023:03:22:12 +0000] "POST /purchases/subscriptions/apple HTTP/1.1" 200 31 "-" "Apache-HttpClient/4.5.8 (Java/11.0.15)"

Possible Solution

I'm not sure where the problem lies - whether it's an issue within LIAP, or it's an issue with Apple and their poor documentation. I have submitted a TSI with Apple and am happy to share the results.

A possible fix could be to have a dynamic url based on the routing config. As a temporary fix for testing, I'm simply passing anything from /purchases/subscriptions/apple through to /liap/notifications?provider=app-store.

    Route::post('/purchases/subscriptions/apple', function (Request $request) {
        $data = array_merge($request->all(), [
            'source' => '/purchases/subscriptions/apple',
        ]);
        return Http::post(config('app.url') . '/liap/notifications?provider=app-store', $data);
    });

Additional Context

Example of an entry within access.log when the Sandbox Server URL is set to https://<your-site>/liap/notifications?provider=app-store

17.58.63.214 - - [23/Jan/2023:03:22:12 +0000] "POST /purchases/subscriptions/apple HTTP/1.1" 200 31 "-" "Apache-HttpClient/4.5.8 (Java/11.0.15)"

[imdhemy]

Hi @leightonkuchel

As you already know this kind of issue requires some debugging. I'm always happy to help, but I may ask you some basic questions or even ask trying some fool-proof steps to make sure we are on the same page. Please bear with me.

From your issue description, I can say that you know every detail about the documentation provided by LIAP, but anyway I'm going to mention the upgrade guide.

For now, let's make sure your server is receiving the test notifications from Apple. You can add a dummy endpoint that receives the notifications and log them. (Without redirecting to LIAP handler).

If the server is receiving the notifications, so the problem is in LIAP. Otherwise, the problem is related to Apple.

-- EDIT --

One more thing, test notifications require using notifications v2.

[leightonkuchel]

Hey @imdhemy, happy to help. Thought I'd raise an issue now incase others are having the same problem so they see that it's currently being investigated.

Sorry if I wasn't clear enough in the original ticket, here's some further information which should help.

• I did go through the upgrade guide, however there wasn't any mention about url changes, so I updated to the latest recommended (/liap/notifications?provider=app-store)
• I have updated our app to support Notifications v2
• I have added some middleware (needed some tweaking) as part of debugging.
• I do successfully receive test notifications from Apple. Here are some more details.

--

Scenario 1
App Store Connect Sandbox URL set to https://<yoursite.com> and notifications V2

// Laravel app
php artisan liap:apple:test-notification --sandbox
Test notification token: b33c3ba4-6d2d-4ae9-ae68-3dc23800662c_1674501909235

// access.log
17.58.63.196 - - [23/Jan/2023:19:25:10 +0000] "POST /purchases/subscriptions/apple HTTP/1.1" 404 2094 "-" "Apache-HttpClient/4.5.8 (Java/11.0.15)"

--

Scenario 2
App Store Connect Sandbox URL set to https://<yoursite.com>/liap/notifications?provider=app-store and notifications V2

// Laravel app
php artisan liap:apple:test-notification --sandbox
Test notification token: d98f0317-580f-4b65-a481-83935096750c_1674502168645

// access.log
17.58.63.214 - - [23/Jan/2023:19:29:29 +0000] "POST /purchases/subscriptions/apple HTTP/1.1" 404 2094 "-" "Apache-HttpClient/4.5.8 (Java/11.0.15)"

--

Scenario 3
App Store Connect Sandbox URL set to https://<yoursite.com>/purchases/subscriptions/apple and notifications V2

// Laravel app
php artisan liap:apple:test-notification --sandbox
Test notification token: 85431624-b099-4a9a-8441-6835be315e70_1674502247628

// access.log
17.58.63.214 - - [23/Jan/2023:19:29:29 +0000] "POST /purchases/subscriptions/apple HTTP/1.1" 404 2094 "-" "Apache-HttpClient/4.5.8 (Java/11.0.15)"

--

Scenario 4
App Store Connect Sandbox URL set to https://<yoursite.com> and notifications V2

// Laravel app
php artisan liap:apple:test-notification --sandbox
Test notification token: c5b0909f-0323-4217-8d69-e16d03294c08_1674502416707

// access.log
17.58.51.6 - - [23/Jan/2023:19:33:37 +0000] "POST /purchases/subscriptions/apple HTTP/1.1" 404 2094 "-" "Apache-HttpClient/4.5.8 (Java/11.0.15)"

--

Scenario 5
App Store Connect Sandbox URL set to https://<yoursite.com> and notifications V2, with a dummy route.

// routes
    Route::post('/purchases/subscriptions/apple', function (Request $request) {
        \Log::debug('RECEIVED /purchases/subscriptions/apple');
        return;
    });

// Laravel app
php artisan liap:apple:test-notification --sandbox
Test notification token: 5a5fcd85-08ac-42f3-b284-20eee5ab298d_1674502859809

// log
[2023-01-23 19:41:00] xxx.DEBUG: RECEIVED /purchases/subscriptions/apple

// access.log
17.58.61.20 - - [23/Jan/2023:19:41:00 +0000] "POST /purchases/subscriptions/apple HTTP/1.1" 200 31 "-" "Apache-HttpClient/4.5.8 (Java/11.0.15)"

--

Scenario 6
App Store Connect Sandbox URL set to https://<yoursite.com> and notifications V2, with my routes hack that I mentioned in the original ticket.

// Laravel app
php artisan liap:apple:test-notification --sandbox
Test notification token: 3d5ebeea-33ba-4a52-84ef-ab21f23315f7_1674502504383

// access.log
52.44.48.157 - - [23/Jan/2023:19:35:05 +0000] "POST /liap/notifications?provider=app-store HTTP/1.1" 200 5 "-" "GuzzleHttp/7"
17.58.51.6 - - [23/Jan/2023:19:35:05 +0000] "POST /purchases/subscriptions/apple HTTP/1.1" 200 31 "-" "Apache-HttpClient/4.5.8 (Java/11.0.15)"

--

I still haven't heard back from Apple DTS, but it seems that Apple only takes the domain from the url you provide, and adds a fixed path to the end (/purchases/subscriptions/apple).

Edit: copy and extra scenario.

[imdhemy]

I believe this is related to Apple as they are sending the notifications to the old URL from LIAP v.0. Maybe it may take some time to update the URL in Apple's servers.

If you are asking for a dynamic URL, you still can add your own route and use the same controller. Don't worry, you are not going to lose any functionality.

In routes/web.php you can add the following route:

use Imdhemy\Purchases\Http\Controllers\ServerNotificationController;

Route::post('/purchases/subscriptions/apple', ServerNotificationController::class)->name('liap.serverNotifications');

Don't forget to add your custom middleware.

I'm closing this issue for now, please feel free to reopen it if required.