title: Validating use of MVC application with license config in database
body: <p>I am currently trying to secure our application so that it is unusable if the license expires. There is a registration key stored in our database that I use to determine the validity of the license.</p>
  
  <p>My original idea was to use Session_Start in the global.asax file to refer to the license details and issue a redirect to an "update your license page" if necessary. Following the redirect I was calling Session.Abandon() in my controller action so that any further requests for pages would repeat the same process.</p>
  
  <p>The problem with this approach is if the user refreshes the page I seem to get a redirect loop occurring. This makes me think that Session_Start is not the best idea but I was trying to avoid placing code in BeginRequest or similar. It is also going to be messy to bypass during valid attempts to update the license.</p>
  
  <p>I currently modified the idea to make an AJAX call when the error page is loaded to trigger Session.Abandon on the server side but this still feels wrong and is open to abuse if someone realises how it works.</p>
  
  <p>The whole application is secured using Windows Authentication so I don't have the option to evaluate the licensing during a login attempt which would have been what I would do with Forms Authentication.</p>
  
  <p>Any suggestions for an alternate approach?</p>