Comments please on seemingly 'Too Easy' method to verify receipts - ios

Question

I believe that to say that receipt verification help from Apple is obfuscated is an understatement.
Somehow I have been able to put some code together that does not use OpenSSL or ASN1 which SEEMS TO WORK to let me get access to the Receipt Fields as readable strings for all receipts for a bundle (including the most current which may not have been even generated by the current device).
This is a work in process, as you can see by the todo's, but could someone tell me why I should not use this method because it just seems too easy from all that I have read on the subject?
Also can anyone help me with the todo's? Like what I need to do at todo1 and 2 (I think i can handle 3, 4 and 5)?
In my case I am scanning the 'latest_receipt_info' receipts from most recent to earliest until I find the in-app product_id I am interested in and then determining its expired status from 'expires_date_ms'. Is that the proper way to determine current expired status of a product_id?
Anyway here it is:
NSURL *storeURL;
exms = [[NSUserDefaults standardUserDefaults] doubleForKey:#"exms"]; //globally defined elsewhere
[[NSUserDefaults standardUserDefaults] synchronize];
NSDate *today = [NSDate date];
int64_t nowms = 1000*[today timeIntervalSince1970];
if (nowms> exms){ //todo maybe give a week grace here
isSubscribed= NO; //globally defined elsewhere
// Load the receipt from the app bundle.
NSURL *receiptURL = [[NSBundle mainBundle] appStoreReceiptURL];
NSData *receipt = [NSData dataWithContentsOfURL:receiptURL];
if (!receipt) { /* No local receipt -- handle the error. */ } //todo1
/* ... Now Send the receipt data to server ... */
// Create the JSON object that describes the request
NSError *error;
NSDictionary *requestContents = #{#"receipt-data": [receipt base64EncodedStringWithOptions:0],
#"password": #"put your shared secret here"};
NSData *requestData = [NSJSONSerialization dataWithJSONObject:requestContents options:0 error:&error];
if (!requestData) { /* ... Handle error ... */ } //todo2
NSString *file=[NSHomeDirectory() stringByAppendingPathComponent:#"iTunesMetadata.plist"];
if ([[NSFileManager defaultManager] fileExistsAtPath:file]) {
// probably a store app
storeURL = [NSURL URLWithString:#"https://buy.itunes.apple.com/verifyReceipt"]; //todo3 test this for sure rather than ifdef debug
}else{
storeURL = [NSURL URLWithString:#"https://sandbox.itunes.apple.com/verifyReceipt"];
}
NSMutableURLRequest *storeRequest = [NSMutableURLRequest requestWithURL:storeURL];
[storeRequest setHTTPMethod:#"POST"];
[storeRequest setHTTPBody:requestData];
// Make a connection to the iTunes Store on a background queue.
NSOperationQueue *queue = [[NSOperationQueue alloc] init];
[NSURLConnection sendAsynchronousRequest:storeRequest queue:queue
completionHandler:^(NSURLResponse *response, NSData *data, NSError *connectionError) {
if (connectionError) {
/* ... Handle error ... */ //todo4
} else {
int64_t edms= 0;
NSError *error;
NSDictionary *jsonResponse = [NSJSONSerialization JSONObjectWithData:data options:0 error:&error];
if (!jsonResponse) { /* ... Handle error ...*/ } //todo5
// Get object from the root object
NSArray *dictionaryObject = (NSArray *)[jsonResponse objectForKey:#"latest_receipt_info"];
NSDictionary *rcpt;
for (int i=[dictionaryObject count]-1;i>-1;i--){
rcpt= [dictionaryObject objectAtIndex:i];
NSString *pid= [rcpt objectForKey:#"product_id"];
if ([pid isEqualToString:#"put your in-app purchase you are interested in here"]){
edms= [[rcpt objectForKey:#"expires_date_ms"] longLongValue];
break;
}
}
NSDate *today = [NSDate date];
int64_t nowms = 1000*[today timeIntervalSince1970];
if (nowms> edms){
isSubscribed= NO;
}else{
isSubscribed= YES;
}
exms= edms;
[[NSUserDefaults standardUserDefaults] setDouble:exms forKey:#"exms"];
[[NSUserDefaults standardUserDefaults] synchronize];
if (isSubscribed== YES) _isexpiredView.hidden= true;
}
}];
}else{
isSubscribed= YES;
}

Answer 1

The mechanical steps of receipt validation aren't hard and your implementation addresses these. Doing it securely is more difficult as you cannot trust the end-user device.
The first issue I see is that you are storing the expiration date in NSUserDefaults and you only validate the receipt if "now" is after the expiration date. So I can simply put an expiration date far into the future into NSUserDefaults and you will never expire the subscription nor check to see if the expiration date is valid. Using an encrypted value and storing in the keychain would make it more secure.
Secondly you are validating the receipt directly from the device to the Apple server. From the Receipt Validation Programming Guide
Use a trusted server to communicate with the App Store. Using your own
server lets you design your app to recognize and trust only your
server, and lets you ensure that your server connects with the App
Store server. It is not possible to build a trusted connection between
a user’s device and the App Store directly because you don’t control
either end of that connection.
What this is saying is that by connecting directly from your device you make it easy for someone to spoof the Apple Server. If you validated that the receipt was signed by Apple then this would be harder, but as it is you blindly trust the expiration date in the receipt.
Your approach is OK as long as you trust your users are honest.