Verify used to send a GET, but its changing to a POST. "If the verify URL is present, the receiving party may verify it by issuing a POST request to it, where the message body contains the complete receipt" We'll need to verify the state of the receipt when we get it as well and discuss what else we should be doing on the server.

As per meeting yesterday: - Crack open the receipt, which will verify the crypto. - Check the user has purchased and not refunded. If it works: - We'll return a 200 status code, {"status": "ok", "receipt": {... the JSON in the receipt }} If it fails because of refund: - We'll return a 200 status code, {"status": "refund"} If it fails because the receipt is tampered with, false, or just plain wrong: - We'll return a 200 status code, {"status": "invalid"} If there's some other error: - We'll return a 500 status code

If anything connections take longer than 1 second: - Send a 503. Think about if we can send a useful retry-after header

https://github.com/mozilla/zamboni/commit/80fe70 We'll need bug 702775 done before we can test.