3 ms·

Is this validation actually performant or secure? It seems like if you implement this on the client side, you end up using JavaScript and the client can just ru

Is this validation actually performant or secure? It seems like if you implement this on the client side, you end up using JavaScript and the client can just run code that patches the call to the server to have it always pass. Then if you implement this on the server side, then you pay a latency penalty for every request, as you have to verify the token sent to your server against the keygen.sh server. It seems like this is either insecure or you pay an RTT latency penalty on every authenticated request. Is this correct? Is there something I'm missing here?

seanwilson 10y ago
> It seems like if you implement this on the client side, you end up using JavaScript and the client can just run code that patches the call to the server to have it always pass. Not sure there's anything practical you can do about that. You're not going to be able to stop hackers figuring out a bypass. Your goal should be to make the license check bypass inconvenient enough that regular users would rather pay for a license (e.g. requires a new bypass each version upgrade).
- ezekg 10y ago
  Definitely. I've seen implementations that require a login before the app is able to be used, but also others that simply have a flash message that kindly asks the user to login. If your app performs auto-updates, then you can also require a valid license before updating, which would be handled server-side somewhere. In the end, it all depends on the product.
ezekg 10y ago
That's assuming that you require license validation with every request though, when in reality you really only need that information periodically. If you're using Keygen alongside your own API, then that information can be cached and requested when needed. It would be integrated the same way you would integrate something like Stripe; you request information when required, and keep your own records up to date via webhook events. For example, a desktop app would really only need to validate a users license after they have successfully logged in after booting the app; you likely wouldn't need to validate the license again for at least 24 hours, and that's assuming you wanted to perform periodic license validations for long-running sessions.
- natdempk 10y ago
  This is a good point. I guess it depends on the characteristics of your application, and the level of control you want over verifying user activity within your application. Maybe you could only verify very important actions or something if that is all you need.

seanwilson 10y ago

> It seems like if you implement this on the client side, you end up using JavaScript and the client can just run code that patches the call to the server to have it always pass. Not sure there's anything practical you can do about that. You're not going to be able to stop hackers figuring out a bypass. Your goal should be to make the license check bypass inconvenient enough that regular users would rather pay for a license (e.g. requires a new bypass each version upgrade).

ezekg 10y ago
Definitely. I've seen implementations that require a login before the app is able to be used, but also others that simply have a flash message that kindly asks the user to login. If your app performs auto-updates, then you can also require a valid license before updating, which would be handled server-side somewhere. In the end, it all depends on the product.

ezekg 10y ago

That's assuming that you require license validation with every request though, when in reality you really only need that information periodically. If you're using Keygen alongside your own API, then that information can be cached and requested when needed. It would be integrated the same way you would integrate something like Stripe; you request information when required, and keep your own records up to date via webhook events. For example, a desktop app would really only need to validate a users license after they have successfully logged in after booting the app; you likely wouldn't need to validate the license again for at least 24 hours, and that's assuming you wanted to perform periodic license validations for long-running sessions.

natdempk 10y ago
This is a good point. I guess it depends on the characteristics of your application, and the level of control you want over verifying user activity within your application. Maybe you could only verify very important actions or something if that is all you need.