Remote email/license verification idea for digital software upgrader

Question

I have a wordpress theme that I support and upgrade frequently.

It contains a built in upgrader routine that takes a zip file containing the updated files and extracts to the theme directory, overwriting the old files.

I'd like to add a license verification routine to this upgrader routine that asks for the users's email address and password, then does a remote call to my member's database and verifies that the email and password are valid before allowing the routine to continue.

Is this a simple task? What approach would you take? The upgrade request will come from anywhere on the net and will have to call back to my server for the verification.

Its very similar to what WPRobot does to validate upgrades with known email addresses.

Answer 1

Your suggested method is just security through obscurity. The user can easily remove the client-side license check. If you have to do this, a simple way is to use HTTP Basic Auth. Have the client request the zip file with their credentials, and respond with the zip (correct credentials) or 401 Authorization Required (otherwise).