Just chasing some feedback and guidance around how one would implement a user authentication process for an Outlook plugin. For reference, the Outlook plugin merely performs an action when an email is sent while the plugin is active.

My thoughts are this:

  1. User pays for plugin subscription -> Their email address is added to an SQL DB with the 'Active Subscription' field set to "Yes".
  2. When pressing the 'Send' button, the plugin should set a request to the SQL server to check whether the 'Sender Email Address' is present in the database, and if so, check whether it has an active subscription.
  3. If the correct values are present, then perform the add-in action

My questions are:

  1. How does one control the scope of requests that can be sent to the SQL server (i.e. this would be an 'EXISTS' request?) and would this be considered safe?
  2. Is there a risk to saving the emails in plain text so that they can be crosschecked with the database? Could this mean that someone could brute heaps of requests to the server to figure out which emails are registered with the add-in?

Really appreciate your assistance on this one.

  • please don't cross-post: stackoverflow.com/questions/72646254/… "Cross-posting is frowned upon as it leads to fragmented answers splattered all over the network..."
    – gnat
    Jun 16 at 13:59
  • @gnat I have posted here as I realised that my other post is in the incorrect version of the site. No need for a downvote though...
    – Nalhcal
    Jun 16 at 14:02


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.