Software License Dongle for Node.js and Electron

The Node binding ships prebuilt natives, so npm install does not drag node-gyp, Python and a C++ toolchain onto your build machines.

npm install @keynub/licdongleCode language: Bash (bash)

const { Context } = require('@keynub/licdongle');

const ctx = new Context();
const dongle = ctx.open();          // first dongle found
dongle.verifyGenuine();             // throws unless genuine

const session = dongle.openSession();
const license = session.readRecord('license');

session.close();
dongle.close();
ctx.close();Code language: JavaScript (javascript)

Electron: check in the main process

This is the one Electron-specific thing worth saying. Do the dongle work in the main process, not the renderer. A renderer is a browser context: its JavaScript is shipped as readable source inside your app bundle, and anyone can open devtools against it. Anything you decide in the renderer, the user can re-decide.

Better still, decrypt the data your application needs in the main process and pass the result over IPC, rather than passing a boolean the renderer is trusted to honour.

And the rule that matters in every language: do not branch on a boolean. Encrypt data your program genuinely needs with appEncrypt at build time and decrypt it through the dongle at run time, so removing the check leaves the program with nothing to compute rather than a working unlicensed copy.

Why an FFI rather than a native addon

The binding reaches the C core through koffi, an FFI. For an Electron dependency that is the difference between working and becoming a support burden: no node-gyp, no Python and no C++ compiler on every developer’s machine, and – the one that really matters – no rebuild for each Electron ABI. A native addon has to be recompiled for every Electron version you upgrade to. An FFI binding does not.

The trade is that the C signatures live in the binding as strings no compiler checks, so each one is held to the C prototype it mirrors.

Code

Runnable sample: nodejs/verify_and_read.js. Binding source: bindings/nodejs. Both are Apache-2.0, in the public SDK repository; the prebuilt native libraries are in the repository’s natives/ folder, one per platform.

All supported languages · All industries · Buy a KeyNub · Ask us something