CODEWITHSUNDEEP
android-pay
luiss
luiss

Reputation: 373

Can I use a plain text JWT with Google Wallet?

I'm trying to create a 'donation' button using Google Wallet. The user should be able to type in an amount into a text box and click a 'donate' button.

It was possible to do this without any server side code with Google Checkout in the past, but with Google Wallet, I need to provide a server side service to compute the JSON Web Token (JWT) for use with the Google Wallet API.

In an attempt to skip the need for a server side service, I attempted to create a plain text JWT, as per the JWT specification. Google Wallet did not like it. It complained about missing text where the JWS signature would be, even though I set the JOSE header to indicate there was no encryption.

  1. Does Google Wallet support a plain text JWT?
  2. If Google Wallet does support a plain text JWT, what can I specify as JWS signature, give that Google Wallet does not like the empty string as specified in the JWT spec?
  3. Even if it was possible, am I overlooking some potential security issue generating a plain text JWT on the client? Again, these are for donations, whose amounts are specified by the client anyway.

Upvotes: 0

Views: 497

Answers (1)

EdSF
EdSF

Reputation: 12349

I'm skipping the "Donations" use case (you'll have to check with official Google Support for that).

I set the JOSE header to indicate there was no encryption.

Nope, not supported....

2 (Server): Generate a JSON Web Token (JWT)

The Google Wallet for Digital Goods API uses JSON Web Tokens—or JWTs, pronounced like the English word jot—to represent each item for purchase in JSON format. To securely verify the origin of these JWTs, you'll encode and sign them with a secret key before passing them to the client.

Because you sign the JWT using a secret key (the Seller Secret), you must generate the JWT using server-side code....

Hth...

Upvotes: 1

Related Questions