Question

I have a situation where I am building a web service hosted on IIS that requires a license file to be on the filesystem before starting up successfully. I’m wondering where I should put the code that does the license check to prevent the Website from actually starting.

I have found there is a function Application_Start but this isn’t called until someone makes an initial request.

Ideally, the app would check the license and log an error in the Windows Event Log when the IIS Admin tries to start the website itself. Is this possible? If not, are there any best practices for this type of situation?

Answer 1

Bombing an entire website because a part of it that uses your component which isn’t registered is very bad form.

To that end, I you could put something in the static constructor(s) of your class(es) that checks the licensing and then throws an exception (any will do) if your licensing requirements are not found, like so:

public static MyComponent
{
    static MyComponent()
    {
         // Check for licensing here.
         if (!<licensing condition>)
         {
             // Bomb the app.
             throw new InvalidOperationException("Component is not licensed.");
         }
    }
}

If you really want to bomb the entire website, then you’ll more than likely have to do this outside of ASP.NET, and write an ISAPI filter (note, you have to do it in unmanaged code) and get it installed on the IIS server.

Or, you could implement the IHttpModule interface. In the Init method implementation you could check for your licensing requirements. If the requirements are not set, then throw an exception, like so:

public class MyLicensingHttpModule : IHttpModule
{
    public void Init(HttpApplication context)
    {
         // Check for licensing here.
         if (!<licensing condition>)
         {
             // Bomb the app.
             throw new InvalidOperationException("Component is not licensed.");
         }            
    }
}

(Note that you still have to register the IHttpModule implementation)

A better solution would be to implement IHttpModule, but set a flag that your libraries/components can access as needed:

public class MyLicensingHttpModule : IHttpModule
{
    // Set when the application is initialized
    public static IsLicensed { get; private set; }

    public void Init(HttpApplication context)
    {
         // Check for licensing here.  Set
         // the flag accordingly.
         IsLicensded = <licensing condition>;
    }
}

The flag would subsequently be checked for in every constructor and/or static constructor to ensure compliance:

public class MyComponentA
{
     static MyComponentA()
     {
          // Check here.
          if (!MyLicensingHttpModule.IsLicensed)
          {
              // Bomb the *type*.
              throw new InvalidOperationException(
                  "MyComponentA is not licensed.");
          }
     }
}

public class MyComponentB
{
     public MyComponentB()
     {
          // Or check on a per-instance basis.  You'd do
          // this if you needed properties on the class level
          // to be available regardless.  This is the
          // *less* likely scenario.
          if (!MyLicensingHttpModule.IsLicensed)
          {
              // Bomb the *instance*.
              throw new InvalidOperationException(
                  "MyComponentA is not licensed.");
          }
     }
}

This would force installation of the module (without it, the flag is not set, which would cause an exception to the thrown), and should give you the opportunity to hook into every page request that uses your component and prevent usage if you wish.

If you do go this route, I have to reemphasize that it’s in very bad form to bomb the entire application, and you should really focus on your component when it is used; this isn’t really your call to make.

It’s very possible that the developer(s) have other pages that do not use your component, while using other paid components which should render just fine.

Also, if you hook into every request, you should make sure that you don’t do anything to incur a performance hit. That would also be in bad form as well. This is why you set the flag once and then do a simple check when you need to.