Licensing

Licensing allows you to gate your application and require a product key for activation. This templates provides an implementation for this using cryptographically signed objects. This technique allows a server to cryptographically sign an object (using a private key) and send it to the client (application). The application can then confirm the signature using a different (public) key and be sure that it was indeed generated by the server.

There are many ways to gatekeep your app. You may not want a license gate for your application but rather a required login to access online services. Depending on your application your needs may vary. This template comes with functionality for managing classic product key based licenses.

Is this 100% safe?

No. All this type of license management boils down to "if(hasBeenActivated) { openApplication() } else { requireActivation() }". Anyone who is motivated enough and knows what they are doing can find ways to bypass this.

The point of the security mechanisms in this template is therefore to:

Make it non-trivial to crack the application
Balance a good user experience for paying users with security requirements
Create a reasonbly good developer experience

Initial Setup

You will need to generate a private and public key for this functionality to work. It is very important that you do not share the private key with anyone.

To generate the necessary cryptographic keys for you application you can use openssl in the terminal:

openssl genrsa -out private.pem 2048
openssl rsa -in private.pem -pubout -out public.pem

Some versions of Windows do not come with openssl pre-installed, in which case you will need to install this or generate the keys a different way. Make sure to keep your private key safe! The public key should be placed in your electron project (and be shared between server and client).

There are keys included in the project for testing. DO NOT INCLUDE THESE TEST KEYS IN PRODUCTION!

Put your public.pem key inside of electron/utils/licenses/public.pem and server/license-manager/public.pem.

Put your private.pem key inside of server/license-manager/private.pem.

Setup Payment Gate

Go to src/main.tsx and scroll down to the return statement where you will find a reference to the payment gate. Configure the activationType to the type you would like it to be (see the component for more information).

Online Validation

If you configure your application to use online validation you can use the included server to try out this functionality. You will need to implement similar functions inside of your real application server, so think of this as an example.

When running the server using npm run dev:all or npm run dev:server you can access the activation server at http://localhost:3000 in a browser to view a list of "fake" generated licenses. Use any of these try out the activation functionality.

If you want to use online validation in production you will need to edit the production url defined in electron/utils/licenses/lincense-manager.mjs.

How It Works

The client will send the user's inputed product key as well as a fingerprint ID of the device to the server. The server will look for the provided product key in its database. If it exists the server will generate a payload with information such as when the license expires, what type of license it is (online or offline) and for what version of the software it is issued. This is cryptographically signed and sent to the client. The client receives the messages, decrypts it and confirms the signature. It then stores this payload locally.

Upon online validation the client sends this payload back to the server, which re-confirms the signature on its end as well as the information within it and issues a response to the client based on this information. The client will also perform offline validation regularly to check and see if the information in the local payload is still correct and valid.

In some setups people will hash the product keys in the database (similar to passwords). This is something to consider, but if you are using external services to manage your keys, like Gumroad or Lemonsqueezy then this would not be an option.

Offline Validation

You can support offline validation by having the server generate offline keys. These require no online validation at all and are cryptographically safe in the sense that the client can determine that they are indeed provided by your server. The downside of this is that the key can be copied and used an unlimited amount of times. An example of this can also be found on the root route of server/server.ts. These keys are in essence just signed objects with a version number and expiry. You can play around with this concept and create different variations to the approach as well.

Testing

When you run npm run dev:all a test server will run on localhost:3000. Go to the root url (http://localhost:3000) and the server will print out test-licenses that you can use during development.

Project Configuration