Just chasing some feedback and guidance around how one would implement a user authentication process for an Outlook plugin. For reference, the Outlook plugin merely performs an action when an email is sent while the plugin is active.
My thoughts are this:
- User pays for plugin subscription -> Their email address is added to an SQL DB with the 'Active Subscription' field set to "Yes".
- When pressing the 'Send' button, the plugin should set a request to the SQL server to check whether the 'Sender Email Address' is present in the database, and if so, check whether it has an active subscription.
- If the correct values are present, then perform the add-in action
My questions are:
- How does one control the scope of requests that can be sent to the SQL server (i.e. this would be an 'EXISTS' request?) and would this be considered safe?
- Is there a risk to saving the emails in plain text so that they can be crosschecked with the database? Could this mean that someone could brute heaps of requests to the server to figure out which emails are registered with the add-in?
Really appreciate your assistance on this one.
