2 added 75 characters in body
source | link

I have a vanilla php api(on a vds) and I want to make data coming from that api available to a few clients that are using a python app that's also written by me. That python app is running on my client/s pc. But now i'm facing a problem: that app can be "pirated".

How do I make sure that the access is limited to only my paid subscribers?

I know that "DRM" or copy protection won't work therefore I was thinking about using tokens that are only available 1 day. And each call will send an Authorization header and based on that the api can decide what to do.

private function check_authorization(){
    if(Server::exists('HTTP_AUTHORIZATION')){
        $this->_credentials$credentials = preg_split('/[\s:]/', trim(Server::get('HTTP_AUTHORIZATION')));

        //try to authenticate the user using those credentials

        return true;
    }
    return false;
} 

Now I was thinking about binding those tokens to 1 IP/day but then there's the dynamic ip and the spoofing problem.

Also I was thinking about using something like Steam way to authenticate new devices for a user: new device? just send a 6 digits code trough email and ask the user to send it over to the api for confirmation. But if i can't identify the device, other than its ip it'll be pretty painful for those clients who happen to be less fortunate and have a dynamic ip.

Should i go as far as checking the operating system, maybe even get the mac and bind my tokens to those macs? Is that even possible?

Thank you!

I have a vanilla php api(on a vds) and I want to make data coming from that api available to a few clients that are using a python app that's also written by me. That python app is running on my client/s pc. But now i'm facing a problem: that app can be "pirated".

How do I make sure that the access is limited to only my paid subscribers?

I know that "DRM" or copy protection won't work therefore I was thinking about using tokens that are only available 1 day. And each call will send an Authorization header and based on that the api can decide what to do.

private function check_authorization(){
    if(Server::exists('HTTP_AUTHORIZATION')){
        $this->_credentials = preg_split('/[\s:]/', trim(Server::get('HTTP_AUTHORIZATION')));
        return true;
    }
    return false;
} 

Now I was thinking about binding those tokens to 1 IP/day but then there's the dynamic ip and the spoofing problem.

Also I was thinking about using something like Steam way to authenticate new devices for a user: new device? just send a 6 digits code trough email and ask the user to send it over to the api for confirmation. But if i can't identify the device, other than its ip it'll be pretty painful for those clients who happen to be less fortunate and have a dynamic ip.

Should i go as far as checking the operating system, maybe even get the mac and bind my tokens to those macs? Is that even possible?

Thank you!

I have a vanilla php api(on a vds) and I want to make data coming from that api available to a few clients that are using a python app that's also written by me. That python app is running on my client/s pc. But now i'm facing a problem: that app can be "pirated".

How do I make sure that the access is limited to only my paid subscribers?

I know that "DRM" or copy protection won't work therefore I was thinking about using tokens that are only available 1 day. And each call will send an Authorization header and based on that the api can decide what to do.

private function check_authorization(){
    if(Server::exists('HTTP_AUTHORIZATION')){
        $credentials = preg_split('/[\s:]/', trim(Server::get('HTTP_AUTHORIZATION')));

        //try to authenticate the user using those credentials

        return true;
    }
    return false;
} 

Now I was thinking about binding those tokens to 1 IP/day but then there's the dynamic ip and the spoofing problem.

Also I was thinking about using something like Steam way to authenticate new devices for a user: new device? just send a 6 digits code trough email and ask the user to send it over to the api for confirmation. But if i can't identify the device, other than its ip it'll be pretty painful for those clients who happen to be less fortunate and have a dynamic ip.

Should i go as far as checking the operating system, maybe even get the mac and bind my tokens to those macs? Is that even possible?

Thank you!

1
source | link

Api limit access to subscribers only

I have a vanilla php api(on a vds) and I want to make data coming from that api available to a few clients that are using a python app that's also written by me. That python app is running on my client/s pc. But now i'm facing a problem: that app can be "pirated".

How do I make sure that the access is limited to only my paid subscribers?

I know that "DRM" or copy protection won't work therefore I was thinking about using tokens that are only available 1 day. And each call will send an Authorization header and based on that the api can decide what to do.

private function check_authorization(){
    if(Server::exists('HTTP_AUTHORIZATION')){
        $this->_credentials = preg_split('/[\s:]/', trim(Server::get('HTTP_AUTHORIZATION')));
        return true;
    }
    return false;
} 

Now I was thinking about binding those tokens to 1 IP/day but then there's the dynamic ip and the spoofing problem.

Also I was thinking about using something like Steam way to authenticate new devices for a user: new device? just send a 6 digits code trough email and ask the user to send it over to the api for confirmation. But if i can't identify the device, other than its ip it'll be pretty painful for those clients who happen to be less fortunate and have a dynamic ip.

Should i go as far as checking the operating system, maybe even get the mac and bind my tokens to those macs? Is that even possible?

Thank you!