4 ms·
If the API is publicly documented, how will you stop people from just spoofing the licensing server? I assume you've addressed this issue, but I'd love to know
by Retr0spectrum 10y ago
If the API is publicly documented, how will you stop people from just spoofing the licensing server?
I assume you've addressed this issue, but I'd love to know how.
Edit: From reading a bit more, I understand that this service is mainly aimed at web/online apps, so piracy is a non-issue.
- mappu 10y agoI assume a combination of public/private keypairs and timestamping. If you trust the client to say "yes, validate via the keygen.sh API", then without loss of generality you can probably trust it to validate using a public key and a timestamp.
- ezekg 10y agoYes, this is for online/web-based apps, with an emphasis on JavaScript apps built on Node, Electron, etc. Licenses are validated by making an authenticated GET request to something like `https://evilcorp.keygen.sh/v1/licenses/3qMEarbK/actions/validate` https://evilcorp.keygen.sh/v1/licenses/3qMEarbK/actions/vali.... Depending on how you manage users, you can require them to login (request an API token) before being able to access your app. Depending on if you're performing the validation server-side or client-side, you can either use a product-specific API key (private) or the license owners API token (a signed in user), respectively.