How to Build Stripe Web Checkout in a .NET MAUI App After Epic v. Apple Ruling

·2 views

Following the Epic v. Apple injunction, US App Store apps can now direct users to external web payment flows, bypassing the store's 15–30% commission cut. A technical guide outlines an architecture using ASP.NET Core and .NET MAUI, where a Stripe-hosted checkout page is opened in the device's system browser rather than a WebView, a requirement for app store compliance. Subscription entitlements are granted server-side via Stripe webhooks rather than client-side claims, preventing fraud and enabling purchases made outside the app to unlock in-app features. A key implementation detail is setting the ClientReferenceId field in the Stripe session to link anonymous checkout sessions back to authenticated users when webhook events fire. The same pattern applies to Google's external-offers program and works across any technology stack, with the app checking both store SDKs and the backend API to determine a user's subscription status.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Shai-Hulud npm worm planted IDE backdoors that survived clean reinstalls

A supply chain attack called Shai-Hulud compromised the GitHub account of Node.js package maintainer Jared Wray, leading to malicious versions of widely-used caching packages — keyv, flat-cache, file-entry-cache, and cacheable-request — being published to npm. Because these packages sit in ESLint's dependency chain, any project using ESLint fell within the attack's blast radius regardless of direct installation. The malware scraped credentials from AWS, GitHub CLI, Kubernetes, HashiCorp Vault, and AI tool config files, then used stolen npm tokens to self-replicate across 868 packages and 1,381 versions. Unusually, the worm also wrote a persistence hook into .vscode/tasks.json configured to execute automatically whenever the infected project folder was opened in VS Code, meaning the payload could fire even after developers removed node_modules and ran a clean install. The attack evaded standard defenses entirely — npm audit reported nothing, no CVE was assigned, and the malicious releases carried cryptographically valid Sigstore signatures generated through the attacker's hijacked CI pipeline.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why Permission Systems Are the Hardest Problem to Solve in Low-Code Platforms

Building permission systems for low-code platforms is far more complex than traditional enterprise software, where objects, fields, and workflows are fixed at development time. In low-code environments, users can dynamically create tables, add fields, configure workflows, and build automation, making business objects and org structures constantly changing. This means permissions must go beyond menu access to cover data scope, field-level controls, action rights, and audit requirements for every record. For example, a salesperson, a manager, a finance officer, and a CEO may all open the same customer module yet each see and interact with entirely different data. Field and action permissions are often treated as afterthoughts in enterprise systems, but in low-code platforms they must be foundational design decisions from the start.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Safely Automate Gmail and Calendar Using Claude AI

Anthropic's Claude AI can connect to Google Workspace tools — including Gmail, Calendar, and Drive — via Model Context Protocol (MCP) connectors, enabling users to query and summarize their data through natural conversation. The integration is most effective and lowest-risk when limited to read-only tasks such as morning briefings, inbox triage, and meeting summaries. Experts recommend starting with read-only access for at least a week before enabling any write permissions, and always manually reviewing drafts before sending. High-risk actions — including sending emails, editing calendars, deleting files, or any action affecting other people — should never be delegated to the AI without human approval. The guiding principle is straightforward: let Claude draft and retrieve, but keep all final decisions and dispatches firmly in human hands.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Polaris Brings Full PHP Authentication Stack to Univeros with Single Config Line

A developer has released Polaris, an open-source identity and authentication module built for the Univeros PHP framework, installable via Composer. The module activates with a single line of configuration, automatically wiring 52 endpoints covering authentication, user management, and organization routes. Polaris handles JWT-based access tokens, multi-factor authentication, session management, and role-based authorization without requiring manual service registration. It is designed as a portable, self-contained module so authentication logic can be reused across projects without painful extraction. The release is the first major feature built on top of Univeros since the framework was revived with AI assistance.

0 comments Read more at DEV Community