I have 3 components: My server (let's call it server A) and another not accessible server B. The 3rd component is an extension (written by me) for a framework. This extensions code is open and can be accessed by anyone.

My users have this framework and my extension installed on server B. The extension generates an URL (index.php?validate), which has to be used when registering on server A. When submitting the registration, server A accesses this URL and checks the response. If the response has a status code of 200 and returns the json response {"success": true}, the registration is successful.

So the goal is to assure that the user has installed the extension on his server B.

How is this possible?

Problems: Right now, the user could just create the page index.php?validate and return a static json response without using my extension, because they could just look up the code of the extension and check how the response has to look like. Sending a random id with the request from server A and returning it within the answer of server B is also useless, because they can just debug the request from server A.

Is there any way to validate the existence of my extension on server B, when the extension code can be accessed by anyone?

closed as unclear what you're asking by Xander, Jedi, Xiong Chiamiov, TheJulyPlot, Tobi Nary Jul 27 '17 at 7:31

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 4
    This looks like an XY problem: You are trying to solve an unknown problem X in the way Y but only describe the problems you encounter when implementing Y. It might make more sense to ask X instead (in a new question) and then add Y as an example how you tried to solve the problem but failed so far. – Steffen Ullrich Jul 26 '17 at 20:06

Given that the code of the extension is open and no additional secrets are required to compute the proper response to a server request it is impossible to know if the answer was actually computed by the extension installed on server B, by the extension running somewhere else or by code reimplementing the relevant parts.

Not the answer you're looking for? Browse other questions tagged or ask your own question.