Licensing

To use JSDefender, you must have a valid license key. JSDefender must have access to the key when it runs, and requires an internet connection in order to contact the licensing server. This is done on every run of JSDefender.

If you do not specify a license key, or if your license key is expired or otherwise invalid, JSDefender emits an error message and stops. To obtain or renew a license, contact PreEmptive.

Activating your license may differ based on your license type:

If you have a Build License, your license is just your license key itself,
If you have a User License, the license supplied to JSDefender consists of your license key and your email address.

How to specify your license

JSDefender supports several ways to specify your license:

Setting the license key as an environment variable,
Setting it through a command line option,
Adding it to your JSDefender configuration file.

If you have the license key specified multiple ways, JSDefender will use the first key it finds in the following order:

Command-line option
Configuration file/object
Environment variable

With an Environment Variable

You can set a JSDEFENDER_LICENSE environment variable as your license with or without your email address separated by a colon.

E.g. C3B940E5A00D492AAB45DD28091E9C53

With email: C3B940E5A00D492AAB45DD28091E9C53:my_email@test.com

With the Command-line Option

The command-line interface has a --license option that you can use to pass your license to JSDefender. In case you have a Build License, it would look something like this:

jsdefender --license C3B940E5A00D492AAB45DD28091E9C53 [other options]

For User Licenses, you must also supply an email address:

jsdefender --license C3B940E5A00D492AAB45DD28091E9C53:my_email@test.com [other options]

With Configuration Properties

You can set the license property, and an email property, of the configuration file/object to your license information. For example:

{
  "license": "C3B940E5A00D492AAB45DD28091E9C53",
  "email": "my_email@test.com"
}

Note: Though you can put the license in the configuration file, it is not a good practice. As teams often store configuration files in source code repositories, this makes concealing the license key more difficult; the entire development team can see and use it.

License Status Display

JSDefender displays all licensing information in the command line before the protection takes place.

Successful validation outputs license details. The outcome of version update checks are also displayed.

Connection errors, timeouts or license validation problems are prefixed with ERROR tags. Other issues of note (e.g. warning for expiring license) are prefixed with WARNING.

Internet Connection Requirement

JSDefender requires an Internet connection to verify the license key with PreEmptive's licensing server.

To avoid build failures due to intermittent network issues, JSDefender retries failed connections after 30 seconds. If a connection cannot be made after a retry, the build will fail with an error message describing the network issue.

If the license server response indicates that it is undergoing planned maintenance, JSDefender will retry the connection every 30 seconds for up to 30 minutes, by default. The delay between connection attempts and the timeout value is configurable using the following environment variables:

The JSDEFENDER_MAINTENANCE_RETRY_DELAY variable sets the delay (in seconds) between connection attempts.
The JSDEFENDER_MAINTENANCE_RETRY_TIMEOUT variable sets the duration of the retry period (in minutes) before connection failure.

Both values must be provided as whole, positive integers.

If you need to connect to the internet either through a plain (unauthenticated) proxy or an authenticated proxy, you can set the HTTPS_PROXY environment variable using the following values:

Unauthenticated proxy: set the proxy to the HTTPS_PROXY variable in the <protocol>://<address>:<port> format, where <protocol> can be either http or https, <address> is the domain e.g. your-domain.com, and the <port> is an optional port e.g. 8500; full example https://your-domain.com:8500
Authenticated proxy: set the proxy to the HTTPS_PROXY variable in the <protocol>://<username>:<password>@<address>:<port> format, where <protocol> can be either http or https, <username> is the plain text username for the proxy, <password> is the plain text password for the proxy, <address> is the domain e.g. your-domain.com, and the <port> is an optional port e.g. 8500; full example https://johndoe:password123@your-domain.com:8500

Checking for Updates

During license validation, JSDefender will attempt to check for product updates. Unlike the license validation, JSDefender will continue to run even if there are network communication problems during the update check.

If your product is not up to date, JSDefender will display a warning in the console, after the license information. On a failed connection attempt, connection failure information will be displayed instead.

Checking for updates can be disabled by setting the JSDEFENDER_UPDATE_CHECKS environment variable to false or adding this line to the configuration file:

{
  "checkForUpdates": false
}

Similarly to license keys if this option is set in more than one way, JSDefender will use the first key it finds in the following order:

Configuration file/object
Environment variable