Stateless Ownership of Digital Goods
npm install certificationWhen a customer makes a purchase, do not store data on the server, rather give the customer a unique tamperproof Download Certificate for downloading and re-downloading the purchased product.
The first and foremost is customer email and name as verified by a payment processor, without that information the certificate will not be unpacked.
Fronting customer email and name will discourage the customer from sharing the digital download certificate.
Certificate may be re-issued upon a re-download, meaning that an older certificate may be invalidated by passage of time.
--
- Upon a purchase, user is given a hard to modify/decrypt text string, called certificate.
- The header of the certificate contains a hash.
- The body of the certificate contains data encrypted with a server-side key.
- Body can be decrypted on the server.
- Decryption keys can be changed, older keys can be used.
- Certificates can expire.
- Certificates can be re-issued.
- Certificates are never stored on the server, they are given to the user/client, may not even be emailed.
- The server can be erased and no data-loss will occur; customers with valid certificates can re-download their purchased data.