0

I am developing a mobile application that will have both free and paid versions.

The way I see how I could differentiate between what is a paid and free user is to set a property isPaid on their respective documents.

What I want to understand is how to set the isPaid property on user's document securely.

One option that I see is after successful payment directly access the document that belongs to the user and change the isPaid property. All of that would be done on the mobile application side.

Another option could be to use the Firebase Functions and trigger one to set the correct value on the isPaid property for the given user.

But what could prevent a malicious user from setting these properties directly OR how to ensure that there actually is a pending subscription from Google or Apple and the user really is a paying one.

Currently my Firestore structure looks like this:

{
  "users": [
    { 
        "uid": "123123123123123",
        "name":"Bob",
        "isPaid": false,
        "messages": [
            {
                "messageText":"hello"
            }
        ]
    },
    { 
        "uid": "456456456456456",
        "name":"Alice",
        "isPaid": true,
        "messages": [
            {
                "messageText":"hey"
            }
        ]
    }, 
    ...
}

Thanks!

  • 2
    If you want a free and a paid version of an app, you either deploy two variants of that app (in case you want to make this work offline), or you make the app connect to a server DB and let it query the subscription state from there (in case the app is not intended for offline usage). Why do you want to save the subscription state locally? – Doc Brown Aug 9 at 11:54
  • I would very much like to have only one app, this structure that I've pasted is in Firestore. I'd like to avoid spinning up a backend solution just for this. And I need it locally to know which features a user should be able to access. – Edvinas Aug 10 at 17:40
  • @Edvinas You don't have to have two variants of the app. But anything client side can be controlled by the user. The typical solution to this is making the paid functions dependant on access to a server with login protection. Thus a paid calculator wouldn't be able to add 2 + 2 without going through the server if addition was a paid function. Done that way a hacker can't use the calculator without having write their own addition algorithm. – candied_orange Aug 14 at 10:16
  • @candied_orange good input, thanks! – Edvinas Aug 16 at 5:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.