Issue widget (web application) with activation code

Question

I don’t know if it’s right to ask this question, but I will just do it. I tried to figure out how I want to give out my web application.

This is my situation:

I have created a web application. People who want to use this app can do this for free. BUT , they must be registered on our website.
The application must be bound to a unique key. This key is created as soon as they are registered on our website.
The application is hosted on our server.
A web application should be easy to implement.

I have seen:

I saw other services generating a JS script, for example:

<script type='text/javascript' data-cfasync='false'>window.exampleApi = { l: [], t: [], on: function () { this.l.push(arguments); } }; (function () { var done = false; var script = document.createElement('script'); script.async = true; script.type = 'text/javascript'; script.src = 'https://app.example.com/VisitorWidget/WidgetScript'; document.getElementsByTagName('HEAD').item(0).appendChild(script); script.onreadystatechange = script.onload = function (e) { if (!done && (!this.readyState || this.readyState == 'loaded' || this.readyState == 'complete')) { var w = new PCWidget({c: 'e01fe420-5c14-55p0-bbec-229c7d9t2f0cf', f: true }); done = true; } }; })();</script> 

What i have done so far:

I created a simple web application that requires you to register and log in. From now on, you get an iframe that you can use. I used iframe only for testing.
The web application consists of HTML, CSS, PHP (mostly), JS and jQuery.

I tried:

I tried this one . I am stuck on parts of Python. I have never used / studied this language.
In addition, I am afraid that people will “use” my web application without the right to do so.
I think that the generated key should be sent to our site in order to verify the correctness of the key.

Tips, tricks, guides?

Do you have any tips or tricks? Maybe a criticism?
JSONP, CORS or something else? I never did JSONP or CORS, so any advice on this would be good too!

All is welcome!

Answer 1

Yes, in general, you have an idea correctly.

• The client subscribes to your site, registers his domain and receives an identifier (allows you to call him that way)
• It implements js on its website with correctly implemented id
• An authentication request containing an identifier is sent to the server; also checking the domain (otherwise it would just be easy to copy js and put it on my site).

As for the exact implementation, there are plenty of examples. There is not one size fits all, and this is the best part of it - completely custom to suit your needs. For example, twitter

 <a class="twitter-timeline" data-widget-id="600720083413962752" href="https://twitter.com/TwitterDev" data-tweet-limit="3"> Tweets by @TwitterDev </a> 

Since the php tag is provided and used, I see no reason why it should be mixed with python unless something really specific is required (and I doubt it). So stick with php . On application security - the use of the identifier and some domains whose verification will be verified is fairly fair. There may be some additional metrics that use larger sites / services, but don't worry about that.

Additional reading:

• What is the difference between JSON and JSONP?
• CORS - What is the motivation for implementing pre-flight requests?