Where to obtain public key for GameCenter 3rd party authentication on a server

Question

What is an url to obtain Apple public key?

This one doesn't work: https://sandbox.gc.apple.com/public-key/gc-sb-2.cer

I found only examples where such url is passed by a client itself:

How to authenticate the GKLocalPlayer on my 'third party server'?

Which is the way it's documented: https://developer.apple.com/library/ios/documentation/GameKit/Reference/GKLocalPlayer_Ref/index.html#//apple_ref/doc/uid/TP40009587-CH1-SW25

2. Send the publicKeyURL, signature, salt, and timestamp parameters to the third party server used for authentication.
3. Use the publicKeyURL on the third party server to download the public key.

Of course I can't use it because of security reasons.

Answer 1

为了避免CSRF攻击，我只需使用uri.DnsSafeHost.EndsWith(".gc.apple.com", StringComparison.OrdinalIgnoreCase)检查url。

Answer 2

I don't understand the question. You get the URL from the call to generateIdentityVerificationSignatureWithCompletionHandler. I haven't done this myself, but I guess that you call that function in your app, and then you get the URL among the other stuff. You send it to your server, and the server can then verify the authenticate the user as described in https://developer.apple.com/library/ios/documentation/GameKit/Reference/GKLocalPlayer_Ref/index.html#//apple_ref/doc/uid/TP40009587-CH1-SW25

The URL is not constant, although possibly pseudo-constant. You shall use the URL that is passed to you.