Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

vincent15000's avatar

Check for license before the application loads in the browser

Hello,

I need to have something like this.

The application will be in a docker package.

When a company wants to use it, it will receive a license and the license key will be automatically added in the .env file. This key is generated by protobuf and is signed.

I have to check regularly if the license is valid :

  • once when the application loads in the browser (before the user authenticates)

  • then from time to time while the user uses the application

I wanted to check the license in a midleware, but the idea is to check the license only once when the application loads in the browser. The problem with a middleware is that it's executed at each request.

I specify that the license informations has to not be sent to the browser, all these verifications have to be handled only backend side.

What do you suggest me ?

Thanks for your help.

V

0 likes
10 replies
LaryAI's avatar
Level 58

To achieve the functionality of checking the license before the application loads in the browser and periodically while the user is using the application, you can follow these steps:

  1. Initial License Check on Application Load:

    • Perform the license check on the server side when the application first loads. This can be done in the entry point of your application, such as in the main controller or a specific route that serves the initial HTML.
  2. Periodic License Check:

    • Use a background job or a scheduled task to periodically check the license validity. This can be done using a cron job or a task scheduler depending on the technology stack you are using.
  3. Middleware for Periodic Checks:

    • While you mentioned that middleware is not ideal for checking the license on every request, you can still use middleware to perform periodic checks by setting a session or cache value that tracks the last check time.

Here is a sample implementation using Laravel (assuming you are using a PHP framework like Laravel):

Step 1: Initial License Check

In your main controller or route that serves the initial HTML:

// routes/web.php
Route::get('/', function () {
    // Perform the license check
    if (!checkLicense()) {
        abort(403, 'License is not valid.');
    }

    return view('welcome');
});

Step 2: Periodic License Check

Create a command to check the license and schedule it to run periodically:

// app/Console/Commands/CheckLicense.php
namespace App\Console\Commands;

use Illuminate\Console\Command;

class CheckLicense extends Command
{
    protected $signature = 'license:check';
    protected $description = 'Check if the license is still valid';

    public function handle()
    {
        if (!checkLicense()) {
            // Handle invalid license, e.g., log out users, disable features, etc.
            // This could involve setting a flag in the database or cache
        }
    }
}

Schedule this command in your Kernel.php:

// app/Console/Kernel.php
protected function schedule(Schedule $schedule)
{
    $schedule->command('license:check')->hourly();
}

Step 3: Middleware for Periodic Checks

Create middleware to check the license periodically:

// app/Http/Middleware/CheckLicenseMiddleware.php
namespace App\Http\Middleware;

use Closure;
use Illuminate\Support\Facades\Cache;

class CheckLicenseMiddleware
{
    public function handle($request, Closure $next)
    {
        $lastChecked = Cache::get('license_last_checked', 0);
        $now = now()->timestamp;

        // Check license every 30 minutes
        if ($now - $lastChecked > 1800) {
            if (!checkLicense()) {
                abort(403, 'License is not valid.');
            }
            Cache::put('license_last_checked', $now);
        }

        return $next($request);
    }
}

Register the middleware in your Kernel.php:

// app/Http/Kernel.php
protected $routeMiddleware = [
    // ...
    'check.license' => \App\Http\Middleware\CheckLicenseMiddleware::class,
];

Apply the middleware to your routes:

// routes/web.php
Route::middleware(['check.license'])->group(function () {
    Route::get('/dashboard', 'DashboardController@index');
    // other routes
});

Helper Function

Create a helper function to check the license:

// app/helpers.php
function checkLicense()
{
    $licenseKey = env('LICENSE_KEY');
    // Implement your license validation logic here
    // For example, decode and verify the protobuf signed key
    // Return true if valid, false otherwise
}

Make sure to autoload the helper file by adding it to composer.json:

"autoload": {
    "files": [
        "app/helpers.php"
    ]
}

Run composer dump-autoload to update the autoload files.

This setup ensures that the license is checked when the application first loads and periodically while the user is using the application, without sending license information to the browser.

1 like
Snapey's avatar

You put a check in loginController to verify the code, but then your code is php so the customer just comments the lines?

2 likes
vincent15000's avatar

@Snapey I don't understand what you mean => so the customer just comments the lines.

Well ... no, the login page should not be displayed if the license is not valid. That's a constraint from my client.

gych's avatar

@vincent15000 Only use the middleware on specific routes like the login page? By commeting the lines I think that @snapey means that the customer could remove this license check if they have bad intentions.

1 like
vincent15000's avatar

@gych @snapey Oh ok ... well I don't think that it will be possible for the customer to comment the lines because there will be a protection.

Snapey's avatar

@vincent15000 then why do you need to check a license? They can run the docker image but not change it?

1 like
vincent15000's avatar

@Snapey Because according to the license, there are some restrictions about the usage of the application by the customer. My client wants this behavior.

Snapey's avatar
Snapey
Best Answer
Level 122

Check the licence on every request (with middleware), but cache the answer and put a time limit on the cache so that after, for example 5 minutes, the cache key is gone and you have to call the function to check the code again.

1 like
vincent15000's avatar

@Snapey It's a good idea ... Hummmm ... well ... is it a good idea even if the license is a signed key generated and encrypted with something like openssl and containing protobuf datas ?

Please or to participate in this conversation.