Safewebapp Guide 6 Refresh Browser 6 Navigate List Panel 6 Organize List Panel 6 PHP Programmers 6 Free and Sold Apps 7 Contents Contents-1

SafeWebApp

User Guide Version 2.2

Excel Software www.excelsoftware.com • [email protected] Phone: 702-445-7645 • Fax: 702-445-7814

Copyright and Trademarks MacA&D™, MacTranslator™, WinA&D™, WinTranslator™, QuickHelp™, XojoApp™, MarketBuddy™, ClickInstall™, QuickLicense™, QuickLicense Server™, DocProtect™, WebActivation™, LicenseSupport™, AppProtect™, QLRT Xcode™, AirLicense™, OfficeProtect™, Android License SDK™, PluginFMQLRT™ , PluginXojoQLRT™, PluginProtect Photoshop™, Cloud License™, Cloud License Server™ , Web License Server™, Desktop License Server™, QuickLicenseRT Linux™, MakeDongle™, Safe Activation™, ExcelRT™ and CloudRT™ are trademarks of Excel Software. Copyright 1985- 2018 by Excel Software with all rights reserved. Other trademarks are property of their respective owners and used for illustrative purposes only.

This manual and software are copyrighted with all rights reserved. Under the copyright laws, this manual or the software may not be copied, in whole or part, without written consent of Excel Software, except in the normal use of the software by licensed users or to make a backup copy. The same proprietary and copyright notices must be affixed to any permitted copies as were affixed to the original. Disclaimer EXCEL SOFTWARE MAKES NO WARRANTY OR REPRESENTATION, EITHER EXPRESSED OR IMPLIED, WITH RESPECT TO THIS SOFTWARE, ITS QUALITY, PERFORMANCE, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. AS A RESULT, THIS SOFTWARE IS SOLD "AS IS", AND YOU, THE PURCHASER, ARE ASSUMING THE ENTIRE RISK AS TO ITS QUALITY AND PERFORMANCE.

IN NO EVENT WILL EXCEL SOFTWARE BE LIABLE FOR DIRECT, INDIRECT, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES RESULTING FROM ANY DEFECT IN THE SOFTWARE OR ITS DOCUMENTATION, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. In particular, Excel Software shall have no liability for any programs or data stored in or used with Excel Software products, including the costs of recovering such programs or data.

THE WARRANTY AND REMEDIES SET FORTH ABOVE ARE EXCLUSIVE AND IN LIEU OF ALL OTHERS, ORAL OR WRITTEN, EXPRESSED OR IMPLIED. No Excel Software dealer, agent or employee is authorized to make any modification, extension or addition to this warranty.

Contents

Chapter 1 Index or Free App 7 Introduction 1-1 Free Public Serial Number 7 SafeWebApp and Web Browsers 3 Purchased Serial Number 8 Use a Web App 4 Group License 8 Simplified Development 6 SafeWebApp Conventions 10 Deployment Options 6 Multiple Copies of SafeWebApp 10 Setup Activation Process 7 Royalty-Free License 11 Setup Web App 7 Password Protection 12 Prepare Your Site 8 Protection Methods 13 Sell Your Content 8 Order Processing 14 Shopping Cart 14 Chapter 2 Payment Processor 14 Order Fulfillment 14 Safe Activation 2-1 Customer Account 14 Web App Edit 1 Cache Pros and Cons 16 SafeWebApp Options 3 External Browsers 17 Targets 4 SafeWebApp Android 17 Plugins 5 SafeWebApp Linux 19 Web App Icon 5 Create an Index 5 Chapter 4 Public Index 7 Category 8 Related Products 4-1 User Feedback 8 Drag & Drop 1 License Suspend and Subscription 8 DocProtect 2 Notifications 9 Protected Application 2 Two Distribution Models 3 Chapter 3 SafeWebApp Document 4 Web License Server 4 Advanced Topics 3-1 SafeWebApp Encryptor 5 Target Platforms 1 Batch Encryption 6 Target Specific Content 2 Tagged Page Protection 4 Internet Access and Firewalls 5 Shortcuts 5 Delete SafeWebApp.Data 5 Clear SafeWebApp Cache 5 Safe Activation Login 6 SafeWebApp Guide 6 Refresh Browser 6 Navigate List Panel 6 Organize List Panel 6 PHP Programmers 6 Free and Sold Apps 7 Contents Contents-1

Chapter 1

Introduction

SafeWebApp offers an easy way to turn web content into a sellable product that can be securely licensed and delivered to specific devices. SafeWebApp is used to deliver a product to paying customers or to control access to proprietary content.

Your web content may include HTML files, SWF files, videos, PDFs, EPUBs or essentially anything else that would normally be accessible within a browser.

Web Apps Running in SafeWebApp

Chapter 1: Introduction 1-1

When a customer buys your Web App, they receive the App Name, Serial Number and a download link for the royalty-free SafeWebApp viewer.

The customer downloads SafeWebApp to their device or computer, types the App Name, clicks the Add button and enters the Serial Number into the presented Activation dialog.

Your content runs within the protected SafeWebApp viewer and cannot be shared with other computers or users. A web server manages the activation process, determines which devices can run your application and prevents your content from being viewed by other HTML browsers.

Any developer can use and distribute SafeWebApp by getting a vendor account on the Safe Activation service or self-hosting Web License Server on their own Linux or Windows website.

The vendor controls how many computers can be activated with a Serial Number and what customer data is collected during the activation process. The vendor can allow perpetual access to the protected content or use a subscription model with reoccurring fees.

Several companion tools can be used with SafeWebApp to extend the supported document types and delivery options. For example, EPUB formatted eBooks can be delivered by CD, download or directly through SafeWebApp and used offline.

1-2 Chapter 1: Introduction

SafeWebApp and Web Browsers As a developer, it is important to understand the similarities and differences between SafeWebApp and a general-purpose web browser like Safari, Internet Explorer or Chrome. SafeWebApp is similar in that it presents HTML, plays embedded videos, runs flash content and presents PDF files just like a browser and in fact uses the same core engine as those browsers.

A web browser is designed to navigate from site to site, bookmark popular sites, present multiple tabs and windows or even view the source code of interesting pages. Internet browsing can be a bit chaotic since each site has different organization, advertisements pop up or roam across the screen and some sites only work with certain browsers. In general, a content author has no control over what browser or computer the user has chosen or the capabilities given to the user. This environment is good for Internet browsing, but not so good for a Web App.

SafeWebApp is like a browser that does not present URLs or display to source of web pages. It is controlled by the Web App and presents the content of one specific application at a time.

All of the content of a Web App should be stored in one folder in a hidden location of the vendor’s web site. Those pages are not linked from other web pages or indexed by search engines. Only authorized users running SafeWebApp can see the content.

SafeWebApp allows the Web App to check if required plugins are installed and eliminates the distractions of a typical web browsing experience. The Previous and Next buttons can navigate from page to page within the same Web App, but even those buttons are often hidden so the Web App can fully control the user experience with graphic buttons on the screen.

Excel Software manages information, video and download pages for SafeWebApp at www.excelsoftware.com. Any developer or user can download SafeWebApp free for many targets including Mac, Windows, Linux and Android.

Developer creating solution that run within SafeWebApp can refer users to the Download page on the Excel Software page for the latest edition. Developers with an activate Safe Activation account or Web License Server can provide a link to the unaltered SafeWebApp installers stored directly on their website.

Chapter 1: Introduction 1-3

SafeWebApp Page at www.excelsoftware.com Use a Web App To use a Web App, the user types its name and clicks the Add button. If the Web App requires Serial Number based activation, an Activation dialog is presented with vendor controlled fields.

Once added, run a Web App by double-clicking its name in the List panel. Select and remove a Web App to use that license on another computer.

1-4 Chapter 1: Introduction

List Panel Shows Applications, Videos, PDFs or EPUBs Added to SafeWebApp

Data about each registered Web App is stored in a file named SafeWebApp.data on the customer computer. On launch, SafeWebApp reads that file and presents Web App names on the List panel. The location for the SafeWebApp.data file depends on the computer or device.

macOS /Users/Shared/Ticket/SafeWebApp.data Window OS c:\Users\Public\Ticket\SafeWebApp.data Linux OS /var/ticket/SafeWebApp.data

Chapter 1: Introduction 1-5

Simplified Development SafeWebApp simplifies the development process by allowing a content author to use HTML, Flash, Videos and other familiar web tools and techniques. The platform independent Web App is developed once then distributed to various devices (computer, tablets, phones, etc.) or operating systems (Mac, Windows, Linux, etc.) by instructing the user to simply download the appropriate viewer.

Deployment is easy for the developer and user. No target or application specific installer is required. A user simply downloads the SafeWebApp viewer and adds any number of Web Apps.

Protected content can be delivered directly from the Internet during each use or optionally cached on the user’s computer. Large resources like protected SWF or video files can even be delivered on a CD or flash drive. A developer can generate an Index of Web Apps with a few button clicks. Deployment Options SafeWebApp offers several deployment options to deliver protected content to the user device. Each option uses an initial Serial Number based activation process that requires Internet access but the Internet Cached, Removable Media and SWAD file options allow the user to run offline when no Internet access is available.

Internet Dependent – With this option, protected content resides on your web site and Internet access is required whenever the user runs the Web App.

Internet Cached – With this option, protected content resides on your web site but when accessed by a user the resource is stored in a local cache on the user’s computer. This allows the user to run the application offline and can dramatically improve performance with large resources like SWF, PDF or video files. The Cache Pros and Cons section identifies some constraints placed on a Web App that uses the cache feature.

Removable Media – With this option, protected content is delivered on a CD, DVD, flash drive or other removable media. Once activated, the application can either run without Internet access or as a hybrid web and desktop application.

SWAD File – DocProtect can generate a SWAD file that embeds a video, EPUB, SWF, PDF or HTML collection for offline use by SafeWebApp.

1-6 Chapter 1: Introduction

Setup Activation Process Here are the basic steps to setup an activation process for a Web App. Remember to click the Save Data button at bottom of each page.

• Enter any 26-digit integer Vendor Code on Vendor Info page. • Select Group page in Serial Number section and name a Group. • Generate batch of Serial Numbers assigned to that group. • Configure a Custom Form or use Standard form to collect activation data. • Configure Product linked to Serial Number Group and Custom Form. • Enter Activation Calculation B*B+R+T and any 10-digit Ticket Code. • Set Enable Activation, Serial Number Required and Dynamic License.

If you configure a custom activation form, the Request Number and Serial Number fields must be visible and required. You can optionally make other fields visible and either required or not. SafeWebApp generates a custom activation dialog at the time of activation.

To test unprotected web pages in the SafeWebApp viewer without setting up Safe Activation, just type a URL starting with "http" in the name field and click the Add button. Setup Web App Here are the steps to link your activation process to a specific named Web App.

• Click Add button in Web Apps menu to present the Web App Edit page. • Enter a short name up to 25 characters that the customer will need to type. • Enter a longer title presented to the user when running the Web App. • Select named Product record for activation. • Set Enable Web App checkbox. • Enter URL of first page of protected content with file extension .php. • Increase Reserve time if user needs over 60 minutes of continuous access. • Set optional viewer options and click Save Data button.

Chapter 1: Introduction 1-7

Prepare Your Site Here are the basic steps required to prepare your web site content to be used as a Web App.

• Change file extension of first page of protected content to .php. • Add this line to top of file: • Open NotePad.exe window with no line wrap. • Click link and save "webappvalidate.php" to a file with NotePad.exe. • Upload "webappvalidate.php" to the folder holding your web content pages. • Insert into other pages. • Rename file extension of those pages to .php. • Protect SWF, MP4, PDF, etc. with SafeWebApp Encryptor. Sell Your Content Here are the basic steps required to sell your Web App.

• Give each customer your App Name, a Serial Number and SafeWebApp. • Sell additional licenses by increasing Max Activation on a Serial Number. • Delete Serial Number or set Suspend checkbox to disable a specific license.

1-8 Chapter 1: Introduction

Chapter 2

Safe Activation

Web Apps are defined on either a Safe Activation account or the self-hosted Web License Server. Both servers support similar features presented by the SafeWebApp player running on the target computer or device.

This chapter describes the setup process for a Web App using an account on Safe Activation Service 3. This information may also be helpful when using Web License Server which includes its own user guide. Web App Edit A vendor account on Safe Activation has screens to setup serial numbers, data fields collected from the customer and the activation process itself. Most of the setup required for a specific Web App occurs in the Web App Edit screen.

Chapter 2: Safe Activation 2-1

Define a Web App

In this example, Dog is the Web App Name typed by the user to add the Dog application to the SafeWebApp viewer. The Displayed Title field is the title presented to the user when the Web App is running. The Website URL field is the top page on your web site that contains all the content web pages, images, SWF, PDF, video and other files that implement the application.

Web App Name – This name may contain up to 25 alphanumeric characters.

Enable Web App – This checkbox puts a Web App online and available for use.

Product Activation – This field selects a named Product record that defines the activation process. If the NoActivation option is selected, the user can add a named Web App without entering a Serial Number into an Activation dialog.

Reserve Minutes – This field determines how many minutes a Web Application is available for continuous use when launched from SafeWebApp.

Website URL – This URL is the starting web page of the application in all lowercase letters. If your content resides on a case-sensitive Linux server the main file and all folder names under which it is nested must use all lowercase letters. This page usually has file extension PHP. Add one line of PHP code at the top to validate the user.

2-2 Chapter 2: Safe Activation

Info URL – This optional URL links to an information page on your web site related to a Web App. If this URL exists, an Info button is presented on an Index page that presents a listing of the Web App.

Displayed Title – This field contains text that appears in SafeWebApp above the running Web App. The first 35 characters are displayed as the title of an Index listing for this Web App.

Description – This field contains up to 100 characters of text displayed within an Index listing for this Web App.

Index and List – These checkboxes don’t affect a Web App, but instead are used to create a private or public Index for Web Apps in your account. Refer to the Create an Index section.

SafeWebApp Options Options in this section are only applied when adding a named web app to the SafeWebApp viewer. All HTML pages for a Web App should reside in one folder including the start page referenced from Safe Activation and the webappvalidate.php page.

To help keep the web pages of your content secure, HTML links should use the current target (do not use TARGET=new in HREF links). If you do want a web page presented in a separate window, store it in a different folder and enable the Allow External Browser checkbox.

Allow Other Apps While Viewing - If you set this checkbox, the user can more easily print or record videos from your site by switching to another application while your site is running within SafeWebApp.

Show Viewer Full Screen – By default SafeWebApp remembers the last screen size, screen position and even what Web App was running and returns to that state when launched. Use this checkbox to force the viewer full screen on each launch.

Hide Left/Top PDF Toolbar - The checkboxes can hide the top and left toolbars of a PDF file presented from your web site. These options can disable printing or saving the PDF file for older versions of the Adobe Reader plugin.

Encrypted Cache - This checkbox and the Refresh Date can be used to optimize the presentation of large flash or video files. To use this feature, you must encrypt these files with the SafeWebApp Encryptor.

Chapter 2: Safe Activation 2-3

Run Offline From Cache – Set this option to cache viewed files on the user computer. This feature allows the user to run SafeWebApp offline. Cached files associated with a Web App are automatically discarded when the Web App is removed or updated if needed based on the Refresh Date. Resources protected with SafeWebApp Encryptor remain protected in the cache.

Allow External Browser – Set this option to allow new windows referenced by HTML links to be presented within the default HTML browser assigned to that computer. When not checked, popup browser windows will be disabled.

Hide Previous Next Buttons – Set this option to hide the Previous and Next page buttons. Some Web Apps provide the navigational buttons with screen images.

Accept Feedback at Alternate Email Address – Set this option to enable the Feedback button on the List panel in SafeWebApp when your Web App is selected.

Refresh App Each Launch – Set this checkbox to force all pages of a Web App to be refreshed each time the user runs it. Currently this feature only affects the Win32 and Win64 SafeWebApp targets. This feature can be useful if content of the Web App is frequently changed of if content scaling or offset issues occur.

Group License – Set this checkbox to enable a group license shared across multiple Web Apps. Refer to the Group License section of Advanced Topics chapter.

Quit Untagged Page – This feature offers additional protection to your application, but requires that you add one line of text to each .html and .php page. See the Tagged Page Protection section below or leave this option unchecked.

Minimum Viewer Required – The first release of SafeWebApp had a defined set of features that a Web App can depend on. That feature set may be expanded with newer versions of the viewer. This option allows the Web App to require a minimum version of SafeWebApp. Web License Server and SWAD files require version 2 or later.

Targets Set the Target checkboxes to reflect the targets on which the Web App has been tested. While generic HTML is consistently presented across targets, embedded video, flash or PDF content may be handled differently based on native browser technology.

2-4 Chapter 2: Safe Activation

Plugins A Web App may include embedded video, flash (SWF) or PDF content using third party plugins. Some user computers may not have the required plugins installed. Set checkboxes to indicate plugins required by a Web App. For popular targets like Mac and Windows, SafeWebApp will warn the user if required plugins are missing when adding or running a Web App.

Web App Icon An index can display an icon for each Web App. That same icon is also used on the List panel.

Use Choose File button to locate a 180x180 pixel image file on your computer and click the Upload button. Create an Index The Web App Edit screen can be used to setup an Index of your Web Apps. To create an Index, use the Web App Name field to name the Index and set the Index checkbox. Also set the List in Index checkbox for each Web App entry that you want to appear in that Index and select the name of that Index in the popup menu.

Create an Index of Web Apps

Chapter 2: Safe Activation 2-5

Upload an Icon image, enter a description and an information URL on the Web App Edit page. Set a few checkboxes and together SafeWebApp and Safe Activation will auto-generate an Index of Web Apps from your vendor account.

The uploaded image is scaled to 90x90 pixels when the icon is displayed in an Index or 180x180 pixels when displayed in the List panel in SafeWebApp for a selected Web App.

For best and fastest presentation on all targets, upload 180x180 pixel GIF files. Other formats like JPG, PNG and BMP image formats are supported but transparent GIF files provide the best experience.

The title field displayed at the top may contain up to 35 characters. The description field may contain up to 100 characters. If the Info URL field holds a URL, an Info button is presented in the bottom right of the Index entry. The Web App Name appears as a link that the user can click to add that item to the List panel.

Since you will likely want to give all users access to your Private Index, select NoActivation in the Product Activation field. By default, the user types your Index name and clicks Add to add your Index page to the List panel.

The Website URL field for an Index may contain an image header about 1160 pixels wide that appears above the Index as illustrated below. The URL can reference an offsite image. For best performance, upload your header image to Safe Activation from the Custom Form List & Select page, then type the assigned image name into the Website URL field.

SafeWebApp Public Index

2-6 Chapter 2: Safe Activation

An Index can be used as your own mini App Store where you make the rules, you process the orders, you own the customer data and you collect all of the revenue. Safe Activation includes a simple shopping cart, credit card payment processor integration and order fulfillment features that you may find useful.

A vendor account can hold more than one Index. You can create different named indexes for different subject areas, then assign each Web App to the appropriate Index.

Set the Target checkboxes for an Index entry to properly reflect the targets on which the Web Apps included in that Index are assured to run on. For example, if your Web Apps are tested and sold to run on just Mac and Windows, then do not set the Linux target checkbox. Public Index The Index button presents a dialog that lists Public Indexes. To show the Index button type IndexShow and click Add. To remove the Index button, type IndexHide and click Add.

To include your Index in this list available to all SafeWebApp users, set the List checkbox in the Web App Edit page used to build your Index. Each Web App should first be added to a Private Index for viewing and testing on each target before being added to a Public Index that is visible to the world.

List of Public Indexes

Notice the icon and the description for an Index is shown in blue text on the right when the user selects an Index.

If the user double-clicks the Index name or clicks the Add button, its added to the List panel. The Web App begins running within the View panel.

Chapter 2: Safe Activation 2-7

Category The Category field on the Web App Edit page applies to Index entries. Initially all Public Indexes will be presented within the Index dialog in SafeWebApp. If the Public Index list becomes too long, Indexes will be presented by user-selected Category.

All SafeWebApp targets already support categorized indexes. When categorized indexes are enabled, the SafeWebApp user will see a popup menu when clicking the Index button. Only those Indexes in the selected category will be presented within the Index dialog.

Assign the most appropriate category to your Public Index to ensure interested users can discover it. User Feedback To receive feedback from Web App users, set the Accept Feedback at Alternate Email Address checkbox on the Web App Edit page. Enter an email address in the Alternate Email field on the Vendor Info page.

When a user selects a Web App in the List panel of SafeWebApp, the Feedback button is visible if the publisher accepts feedback. The user can click the button to present the Feedback dialog, type a message and click Send. License Suspend and Subscription To suspend an activated license, set the Suspend checkbox associated with a license Serial Number using the Edit Serial Number page on Safe Activation. If the suspend checkbox is set, the user is presented with a message on next launch of the Web App to indicate that the license has been suspended.

The suspend feature can be used to disable a license for non-payment, refund or license violation. The suspend feature can also be used to manage a software subscription. For a software subscription, the vendor assigns a Serial Number for activation and later sets the Suspend checkbox if the customer allows the subscription to expire.

2-8 Chapter 2: Safe Activation

If the Max Activation field for a Serial Number is larger than 1, multiple computers can be activated with that Serial Number. A customer record is generated during the activation process for each computer. The customer record holds a Request Number that identifies a specific computer. The Suspend checkbox suspends all licenses activated with that Serial Number. Notifications SafeWebApp provides an easy, non-intrusive way for a vendor to notify a user with Web App specific information. A notification can be presented to a group of users. For example, all users of a Web App could be notified of new enhancements. A notification can target a specific user. For example, a user could be notified that their subscription expires at the end of the month.

Here is how the notification system works.

1. Vendor Assigns Notification from Safe Activation 2. User Sees Info Button for Selected Web App 3. User Clicks Info Button to View Notification 4. User Clicks Cancel Notification button to Discard It

Here is the user experience:

The Info button appears in the bottom right corner of the List panel when a Web App is selected to indicate that a Notification is available. When the user clicks the button, the View panel shows the Notification.

The notification name is shown in bold text centered at the top. The body of the notification can use HTML formatting with fonts, colors, pictures or even embedded flash or video.

The user clicks the Cancel Notification button at the top-left corner of the View panel in SafeWebApp to discard a specific named notification. The Info button is no longer visible on the List panel.

If the vendor presents a new notification with a different name, the Info button is visible again. The Safe Activation Help screen describes how to create a standard notification from the Product Edit page or an event-driven Notification from the Event Edit page. Chapter 2: Safe Activation 2-9

Chapter 3

Advanced Topics

This chapter contains topics that affect specific developers, targets or adds additional protection to web content presented by the SafeWebApp player. Target Platforms SafeWebApp is currently available for download in several different target builds. Each version of SafeWebApp works essentially the same. To run SafeWebApp, the user simply double-clicks its icon.

• mac OS 64-bit • Windows (32-bit and 64-bit) • Linux (32-bit and 64-bit) • Android

All modern Mac computers have an Intel processor and will use the 64-bit macOS build of SafeWebApp. This build is referred to as the “macintel” target. The “macppc” target is no longer supported.

The Windows 32-bit edition should be used on older computers. This build is referred to as the “win32” target regardless if it runs on a computer with a 32 or 64- bit processors.

Chapter 3: Advanced Topics 3-1

Windows 10 users should download and use the Windows 64-bit edition. This build of SafeWebApp referred to as the “win64” target uses approximately the same technology as the 64-bit edition of Internet Explorer.

Internet Explorer 64-bit supports embedded video and SWF files, but embedded video may need to be specifically presented within the Media Player plugin. Do not set this target checkbox unless your app has no embed videos or has been specifically tested on that target.

The 32-bit or 64-bit edition of the Linux build of SafeWebApp is referred to as the “linux” target.

A vendor can control what targets are supported. If the target checkbox is not set, the user receives an error message when attempting to add that named app. A Public Index indicates the specific targets supported by the applications listed in that Index. Target Specific Content The Internet supports many technologies (HTML, HTML5, SWF, Videos, PDFs, etc.). Not all browsers (Safari, Internet Explorer, Firefox, Chrome, etc.) on all OS platforms support all technologies to the same extent or in the same way.

Several builds of SafeWebApp are currently available to support these different environments with essentially the same feature set. A vendor should test the content of each Web App running in SafeWebApp on each target that their application claims to support. As with different web browsers, each target may handle web file resources like embedded video, SWF and PDF files slightly different.

To simplify development, SafeWebApp tells the web page what target is running. When SafeWebApp requests a PHP page (like the startup page provided by the WebSite URL field), it sends a target parameter that indicates where SafeWebApp is running. Your web site pages can tailor a response based on that target.

The name of the target is sent as an HTTP GET variable to the web page. This simple PHP page validates the license and displays the target field.

Target:

Currently supported target values include:

macintel, win32, win64, linux, androidphone, androidtablet

For this PHP page, SafeWebApp running on a Mac presents a web page that says: 3-2 Chapter 3: Advanced Topics

Target: macintel

On a Windows 32 or 64-bit computer running the 32-bit target, this web page is presented.

Target: win32

This PHP page presents different content based on the target value presented by SafeWebApp. A Web App named TestTarget was setup with the code below, then viewed within two builds of SafeWebApp running on the same computer.

SafeWebApp uses native HTML viewer technology based on the platform on which it runs.

• On Windows, SafeWebApp uses the same technology as Internet Explorer so it should generally display similar to and use the same browser plugins as Internet Explorer.

• On Mac, SafeWebApp uses WebKit so content should appear similar to the way it appears in Safari.

• On Linux, SafeWebApp uses WebKit so content should appear similar to the way it appears in the Chromium browser.

• On Android, SafeWebApp uses WebKit, the default browser technology for that OS.

Chapter 3: Advanced Topics 3-3

SafeWebApp on Linux is tested on the Ubuntu distribution, but should work on other Linux OS distributions including Fedora or Suse. The user may need to download and install the Chromium browser and associated plugins first to ensure their Linux environment supports the resource types used in a specific Web App including embedded videos, SWF files, etc.

If a vendor claims their Web App runs on Linux, the vendor may need to document system requirements including Linux OS distribution and the browser plugins required. The Linux OS has more variations than the Windows or Mac OS.

A typical Linux computer will probably not support Web Apps with embedded Flash or PDF content. If additional plugins are required, the Web App developer should document and test the setup process. Tagged Page Protection When a user navigates the pages of your Web App using the SafeWebApp viewer, a requested page may not be available due to a variety of reasons:

• Disconnected Internet • Local ISP Disruption • Your Web Server Unavailable • Links to renamed or deleted pages

If your web server cannot locate a web page, it typically presents an error page to the user. Sometimes the default error page shows the full URL of the requested page. To protect your application, you do not want the user to see the URLs of your web pages. While you can probably control the error screen presented by your web site, you cannot control the error screens presented by the local ISP or other nodes in the communication process. Safe Activation and SafeWebApp can help to protect your application from unavailable pages.

Here is how the protection works. Set the Quit Untagged Page checkbox on the Web App Edit page in Safe Activation. Add one of these two lines to every .html or .php page in your content.

• •

Always use the tag unless that page has embedded video since this makes your page display faster on some devices.

3-4 Chapter 3: Advanced Topics

When the Quit Untagged Page checkbox is set when an application is added to SafeWebApp, it enables the protection feature on each use of that Web App.

SafeWebApp checks each loaded .html or .php page for the tag and if not found disables that page. On a Mac, Windows or Linux computer, the linked page is disabled. If the user clicks that link nothing happens. On Android, the user is returned to the List panel. Now if your content has a bad link or the user’s Internet connection is temporarily lost, the user is not presented with an unpredictable web page. Internet Access and Firewalls SafeWebApp is a tool to access Internet content so unobstructed Internet access is required. If the customer computer has a restrictive firewall, the SafeWebApp application may need to be white-listed within that Firewall software. The firewall may also require that the domains holding the Web App and Safe Activation also be white-listed. Shortcuts SafeWebApp supports several keyboard shortcuts that a developer may find helpful when creating Web Apps. Support for these shortcuts may vary slightly between targets.

Delete SafeWebApp.Data To delete the SafeWebApp.data file, hold down the Shift+OS keys on launch. Click Yes in the presented dialog.

Clear SafeWebApp Cache In the setup process on Safe Activation, a vender may enable the caching of encrypted and un-encrypted resources (HTML, SWF, Video and PDF files) on the local computer. This may substantially improve performance and allow offline use of a Web App.

When a selected item is removed by clicking the Remove button, cached files for that item are removed. To clear the entire cache, hold down the Shift key when launching SafeWebApp and click Yes in the presented confirmation dialog.

Chapter 3: Advanced Topics 3-5

Safe Activation Login When setting up a Web App, a vendor works with their web site, their Safe Activation account and SafeWebApp running on a target computer. To present the Safe Activation Login page in a web browser, click on the Name label at the bottom left corner of the List panel while holding down the Shift key.

SafeWebApp Guide To present the SafeWebApp Guide PDF, click the Name label at the bottom left corner of the List panel while holding down the OS key.

Refresh Browser To refresh the View panel in SafeWebApp when running on a Windows computer, click the Title above the content.

Navigate List Panel Use the Up or Down arrow keys on your keyboard to change the selected Web App in the List panel of SafeWebApp. Use the Right arrow to run the current selection.

Organize List Panel Use the Up or Down arrow keys on your keyboard while the Shift key is pressed to move the selected Web App up or down in the List panel of SafeWebApp. PHP Programmers As mentioned above, SafeWebApp intercepts .php files and adds a target parameter to the URL. Your web page can use this to determine what target (win32, macintel, androidphone, etc) SafeWebApp is running on. During that interception process, SafeWebApp does not currently forward POST parameters.

For example, this HTML file doesn’t send the entered data to page2.php.

SafeWebApp only intercepts .php files, not .PHP files. The file extension is case sensitive. If you rename page2.php to page2.PHP and change the action in the HTML form to page2.PHP, the POST parameters pass through SafeWebApp as expected. Alternatively, you can use the GET method instead of POST in both pages.

3-6 Chapter 3: Advanced Topics

Free and Sold Apps Web Apps can be free or sold and may require no activation, activation with a public Serial Number or activation with a private Serial Number. Here are some general guidelines and conventions for how and why to use each approach so your Web Apps fit with user expectations.

Index or Free App A Public or Private Index or a free Web App should set the Product Activation field to NoActivation. When a user views an Index and clicks the App Name link shown at the bottom of each Web App entry, that app is immediately added and begins running in SafeWebApp.

There are several vendor benefits to providing free Web Apps with SafeWebApp. Someone can use your content without being able to view the original source files.

Your app will have a known runtime environment across many targets. As a web content developer, you have already experienced the challenges of developing content that displays consistently across many different browsers, Internet Explorer 32 or 64-bit, Safari, Firefox, Chrome, etc.

If you create a Public Index, your content is discoverable by anyone using SafeWebApp. When a user adds your Index, you now have a free marketing service to promote or sell other content. When a user clicks your Web App it is automatically added to their List panel so they can use it any time unlike web site URLs that are often forgotten.

Free Public Serial Number If your Web App requires a Serial Number, setup an Info URL to a page on your site that either gives the user a Public Serial Number or instructs them how to purchase one. SafeWebApp users will click the Info button to see your Web App product page when viewing your Index.

Your Web App product page can publish a Public Serial Number as illustrated by the example Web Apps on the Animal Tricks Index. This allows the vendor to collect valuable sales contacts when the user completes the Activation dialog. The free Web App registration could trigger an event driven “Hello Customer” email message to inform that user of the other great apps that you offer for sale.

To create a public Serial Number, create a Product record that links to your custom form that determines the data fields you want to collect. Link the Product record to a Serial Number Group that contains one easily typed Serial Number (perhaps something like “FREE”) and assign that Serial Number a large Max Activation number. Chapter 3: Advanced Topics 3-7

To share a public Serial Number across multiple Web Apps, use the Group License feature as described in the section below. Otherwise, if any Web App that shares that Serial Number is removed, then all other Web Apps on that computer sharing that Serial Number will be disabled.

Once data is collected into a customer record on Safe Activation it can be retrieved by the vendor for marketing purposes. A vendor might choose to periodically delete customer records after some time period, perhaps a year or two. If a user attempts to run a Web app and no customer record exists, the Web App is disabled. The user can Remove and Add it again to SafeWebApp.

Purchased Serial Number If your Web App requires a purchased Serial Number, setup an Info URL to a page on your site that describes the application and instructs the user how to purchase it. Use any shopping cart or payment processor you want.

Safe Activation supports a shopping cart, payment processor integration and order completion to enable a fully automated process. After completing the purchase, a Serial Number can be automatically emailed to the user.

SafeWebApp users will click the Info button to see your Web App product page when viewing your Index. Make sure new users that have discovered your Web App know where to buy it. Group License Normally, a separate Product Edit page linked to a group of Serial Numbers controls the activation process for each Web App. When the Web App is added to SafeWebApp, a customer record is created that stores the Serial Number and Request Number of that specific device. When the Web App is removed, that customer record is deleted. Note that each customer record has a unique Serial Number and Request Number combination.

A vendor may want to protect a family of Web Apps with a single Serial Number, while allowing individual Web Apps to be added or removed from SafeWebApp. This cannot be accomplished by simply having each Web App share the same Product Activation since Serial Numbers must be unique for each customer record. To enable this capability, select the same Product Activation record from each Web App and set the Group License checkbox.

3-8 Chapter 3: Advanced Topics

When the Group License checkbox is set, a unique Serial Number is generated at the time of activation that consists of the user entered Serial Number and the Web App name being activated using the format:

SerialNumber-WebAppName

To better understand the implications of a Group License, assume the vendor has three Web Apps named App1, App2 and App3 that share the same Product Activation linked to a group of Serial Numbers that each allow 2 computer activations and each Web App has the Group License checkbox set.

Assume that Serial Number 123456 is given to a customer named John during the purchase process. When John activates App1 on two computers using Serial Number 123456, two customer records are generated. Each customer record has a unique Request Number and the same Serial Number named 123456-App1.

If John activates App2 on any computer, a customer record is create with Serial Number named 123456-App2 and the Request Number for that specific computer. If John chooses to remove a selected Web App, the appropriate customer record is deleted without affecting the other activated Web Apps.

The ability to control a family of Web Apps with a single customer visible Serial Number can simplify the customer and vendor experience. There are a few implications to be aware of when managing a group license from Safe Activation.

There are a few consequences of using a Group License:

• License Status – The Serial Number Status Screen within Safe Activation will always show 0 customer records and 0 active licenses since this screen only counts simple Serial Numbers stored in customer records and license block and unblock codes.

• Customer Search – When searching for a Serial Number within customer records remember the stored value contains both the simple Serial Number and the Web App name separated by a dash.

• Customer Account – Do not enable the Customer Accounts feature since the license status does not accurately reflect the actual active licenses.

Chapter 3: Advanced Topics 3-9

SafeWebApp Conventions SafeWebApp can deliver protected or paid content to specific customers across a wide range of computers and devices. Safe Activation enforces unique names for Web Apps and Indexes. Each Web App name can have up to 25 alphanumeric characters consisting of A..Z a..z 0..9.

Since names are assigned to the first vendor requesting an unused name, early vendors get to pick the best names. Excel Software will not be enforcing conventions, monitoring or governing the use of SafeWebApp by vendors or users unless misbehavior requires it.

There are some Etiquette Guidelines every vendor should follow:

• No ALL CAPS in Web App or Index name unless recognized abbreviation. • Never make Web Apps public until they look professional and are tested. • Never make Index public until it contains at least three Web App entries. • Never add a Web App name unless you intend to publish it within one year. • Never make Index public until first viewed as a private Index. • Excel Software cannot provide technical support directly to your customers.

The goal is to make SafeWebApp fun, consistent and productive for users while keeping it easy, inexpensive and profitable for vendors. We invite you to deliver innovative, dynamic content with stable useful Web Apps. Multiple Copies of SafeWebApp A user will typically have one copy of SafeWebApp running on a their computer with a separate list item for each Web App. The registration data for Web Apps is stored in the SafeWebApp.data file. The user can run one Web App at a time.

Some users may want to run multiple Web Apps at once or use SafeWebApp for different purposes. Duplicate and rename the SafeWebApp application on a desktop computer to create a custom list of Web Apps.

For example, if SafeWebApp is renamed to Educational, it stores its list of Web Apps in the Educational.data file.

3-10 Chapter 3: Advanced Topics

When the Videos application is launched, the window title is Videos. A Web App can be running in the Games application at the same time.

The user can click the Remove and Add buttons to move a Web App from one list to another in seconds. A developer can separate Web Apps being developed from those already on the market that are ready for sale.

Each renamed copy of SafeWebApp has its own list of registered Web App with its own data file and data cache.

If a user renames SafeWebApp after adding some Web Apps, on first launch a dialog is presented. Select an existing data file or create a new empty list of Web Apps. Royalty-Free License

SafeWebApp is free for anyone to download and use on their computer on any supported platform. SafeWebApp is not public domain software. It is a commercial product exclusively owned by Excel Software with all rights reserved.

Most vendors will direct customers to download SafeWebApp from www.safewebapp.com or add download buttons to their web site to download directly from that site.

Any vendor with an active account on Safe Activation Service 3 or has licensed Web License Server is granted a royalty-free distribution license for SafeWebApp. A vendor can store SafeWebApp on their website, distribute it by CD or even include it in a Setup program provided that no changes have been made to the executable.

Independent programmers often author content that is packaged and sold by other companies. Any company or individual that owns and distributes SafeWebApp directly from their web site or by CD will need an active account on Safe Activation Service 3 or license for Web License Server to attain royalty-free distribution rights.

Chapter 3: Advanced Topics 3-11

Password Protection Some organizations may want to restrict who can add or remove Web Apps and who can view the list of Public Indexes. In a school, perhaps only the teacher or school administrator will be given these privileges.

To add or remove passwords, the user must be logged into an Administrator account. On Windows, Right+Click on SafeWebApp and choose Run as Administrator from the popup menu.

The Index button can be password protected. Once protected, the password must be entered each time the Index button is used. The password protection applies to all instances of SafeWebApp running on that computer.

Type PasswordToUseIndex an equal sign and an alphanumeric password with no spaces in the Name field, then click the Add button.

PasswordToUseIndex=YourPassword

When the Index button is clicked, the Enter Password dialog is presented. The Index can only be viewed after entering the required password.

To remove a password from the Index button, type this command and click the Add button.

PasswordToUseIndexRemove

To restrict who can add and remove Web Apps, apply a password in the same manner. Type this command in the Name field and click the Add button.

PasswordToAddApp=YourPassword

The Enter Password dialog is presented when a user Adds or Removes a Web App from the list.

To remove the password, type this command and click the Add button.

PasswordToAddAppRemove 3-12 Chapter 3: Advanced Topics

Protection Methods After investing significant time, effort and money to develop an application, a content author should take reasonable steps to protect the investment from potential hackers and unpaid users. Here are some guidelines to safeguard web content.

• Never Make URLs Public – By default, SafeWebApp does not display URLs when navigating through web content. That step alone, prevents access by casual users. Don’t set the External Browser checkbox or if you do make sure external windows present URLs on a different domain or at a different location than the rest of your Web App content.

• No Links From Public Web Pages – Never link to a Web App content file from a public web page. If you do, search engines like Google and Bing will index and expose your content.

• NoIndex HTML Meta Tag – Use this tag in HTML page headers to discourage web robot indexing.

• PHP WebAppValidate – Use the PHP WebAppValidate technique on the topmost page to disable browsers from accessing your Web App. In a large Web App, you may want to use this technique on other pages perhaps in major topic areas of the application.

• Mangled HTML – Use Mangled HTML pages generated by SafeWebApp Encryptor to make captured URLs useless. Hackers get discouraged when content is too difficult or time-consuming to steal.

• Encrypt Resources – Use SafeWebApp Encryptor to encrypt resource files like SWF, video or PDF files if that technique is applicable to your app.

• Domain Dependent Content – Third party utilities are available to make web content domain dependent. For example, a SWF file can be disabled when attempting to run it from a different domain. Domain dependent files cannot be run offline or use the cache feature in SafeWebApp.

• Copyrights and Watermarks – These techniques may not prevent unauthorized use but can help to solidify your legal claims.

• SWAD – SWAD files created with DocProtect offer good protection for EPUB, Videos and other document types.

When exposing a Web App to users on the Internet, perfect security is an elusive goal. Use a combination of techniques to ensure that it is difficult and time consuming for a hacker to steal your content. Chapter 3: Advanced Topics 3-13

Order Processing Safe Activation provides the capabilities needed to protect, configure, promote and license Web Apps deployed with SafeWebApp. It also provides order processing and integration capabilities to simplify the process of marketing Web Apps.

Shopping Cart To sell software on your web site, use an online order form or shopping cart system. A simple Buy button can present a form to collect payment information for a single product.

A more comprehensive shopping cart might handle many products, quantities and options. Safe Activation provides a simple shopping cart system. It also integrates other sales automation features with almost any third party shopping carts.

Payment Processor Safe Activation does not store or process credit cards. However, it does integrate with payment processors like PayPal and Authorize.Net by simply entering merchant credentials for those systems. Integration with other payment processors is possible by using an external shopping cart or custom programming script.

Order Fulfillment Once a shopping cart has collected the customer order and a payment processor has processed the credit cart, an email is usually sent to the vendor with customer details required to package and ship the product. For a Web App that can be delivered electronically, the order fulfillment process can easily be automated. This typically results in a custom email message containing download links and Serial Numbers for ordered products. Safe Activation can fully automate this process.

Customer Account In some markets, customers may purchase multiple Web Apps or make volume purchases. A customer account that records each purchase and the status of each license can reduce support cost and increase sales. Safe Activation can provide secure customer accounts with a Login page from the vendor’s website.

3-14 Chapter 3: Advanced Topics

The sales, support and marketing features available in Safe Activation can be used for Web Apps deployed with SafeWebApp, Protected Applications created with QuickLicense or AppProtect or Protected Documents created with DocProtect.

Refer to the integrated help system built into the Safe Activation vendor account for more details.

Excel Software has produced a variety of demonstration videos related to software design, protection and licensing. Some videos are publicly available and can be directly played from a web browser. Some videos are included with a specific product or service.

There is a collection of videos specifically related to software licensing and order processing available to anyone with a user account on Safe Activation Service 3. To access these videos, launch SafeWebApp, click the public Index button and add the SoftwareLicenseVideos index. Videos that are specifically related to Service 3 will require the account UserName as a Serial Number when adding the video.

Chapter 3: Advanced Topics 3-15

Cache Pros and Cons There are benefits and consequences to using either the Encrypted Cache or Run Offline from Cache checkboxes that a developer needs to understand to determine if those features are appropriate for a specific Web App.

A SWAD file created with DocProtect often offers a better way to protect and deliver video, SWF, PDF or EPUB files for offline use.

The Encrypted Cache checkbox allows a large SWF, video or PDF file to be encrypted and linked from an HTML or PHP page. It may take longer for a user to access that file on first usage. Since the encrypted file is then stored on the local computer, each usage thereafter can be substantially faster. For example, a large video might take 60 seconds to load on first usage and 1 second thereafter.

An encrypted file cannot be embedded within an HTML page with an HTML5 style Video tag. It must be referenced with an HTML tag like SWF.

The resource file is protected with SafeWebApp Encryptor and encrypted for a specific Web App name. If your Web App name changes, SafeWebApp reports an error when attempting to load that resource file. Streaming video is inherently incompatible with this type of file encryption since the entire resource must be downloaded before it can be presented. The resource file must be standalone and location independent. If a resource like a SWF file is bound to a specific domain or references other resources, then it cannot be encrypted.

The Run Offline from Cache checkbox also stores HTML, PHP and referenced image files in the client computer cache. This means that once all pages and resource of the Web App have been loaded, it can thereafter be run offline without Internet access. That could be useful when a Web App consists primarily of a nicely formatted HTML page linked to a large video, SWF or PDF file.

The Run Offline from Cache checkbox places restrictions on the content of the Web App. All embedded image files must be stored in the folder holding the topmost page of the Web App and referenced with a relative path with an HTML tag exactly as illustrated here:

•

Here are several examples that are perfectly valid HTML but will fail to run properly from cache. In the first two examples, the image file is not referenced with a relative path or stored in a folder holding the topmost page. In the last two examples, the SRC=” portion of the referenced file does not match what SafeWebApp supports. 3-16 Chapter 3: Advanced Topics

• • • •

The Suspend and Subscription licensing features are inherently incompatible with the Cache feature since once loaded, the user can run a cached Web App indefinitely without an Internet connection. External Browsers A Web App developer may seldom want the user to navigate outside of the secure, controlled and well-defined environment of SafeWebApp. If the Allow External Browsers checkbox is set, any link to an external target page is presented in the default browser on that computer which exposes the full URL of that link. To exclude all external links, leave the checkbox cleared.

To explicitly allow one link to be presented in an external browser, prefix the URL with the word external: as shown in the HREF attribute of the HTML tag below.

Excel Software SafeWebApp Android Most web content that is created for SafeWebApp running on a desktop computer with the Mac, Windows or Linux OS can also be used by SafeWebApp running on an Android powered phone or tablet. Phones and tablets present a different user experience and some of these inherent differences affect both SafeWebApp and developer-created content.

• Phones and tables are more mobile and usually connected to the Internet • Screen size is limited and Portrait or Landscape orientation changes • Customers expect more pointing, tapping, gestures and less typing • Applications and data are self-contained with limited user access to files

Chapter 3: Advanced Topics 3-17

The core features of SafeWebApp on Android are essentially the same as those of a desktop computer. A user will add, activate, remove and run Web Apps in essentially the same way. The Private Index, Public Index, Notification and Feedback system also works the same. A developer uses the same setup process to create Web Apps.

The Adobe PDF, Flash Player and QuickTime plugins that are commonly used by desktop browsers and frequently used by SafeWebApp on a desktop computer generally do not apply to Android. QuickTime is not available for Android.

There is no standard inline PDF viewer for Android like there is for Mac and Windows. Although Adobe’s Flash player plugin is supported and works well with some Android OS versions, Adobe plans no future development for Flash on Android, iPhone or iPad.

Web content for Android should focus on HTML5, JavaScript and server based technologies. Inline video can use the new HTML5 Video tag as demonstrated by examples in the SafeWebAppSchool Public Index.

SafeWebApp on Android does not currently support files generated by SafeWebApp Encryptor. Offline cache features are also not supported. SafeWebApp Android currently ignores several checkboxes on the Web App Edit page since they don’t apply or would not provide much value.

SafeWebApp Android ignores these options:

• Allow Other Apps While Viewing • Show Viewer Full Screen • Hide Left and Right PDF Toolbar • Encrypted Cache Refresh Date and Run Offline • Refresh App Each Launch • Plugins Checkboxes

SafeWebApp Android supports private and public indexes similar to the computer desktop editions. By default, no Index button is visible.

To show the Index button, the user must click the Add button, type IndexShow and click the OK button. The Index button remains visible until SafeWebApp is uninstalled or the user clicks the Add button, types IndexHide and clicks OK.

Since an Android device will only have one instance of SafeWebApp installed, the “Multiple Copies of SafeWebApp” section of this guide does not apply.

3-18 Chapter 3: Advanced Topics

On a desktop computer, the SafeWebApp.data file is stored separately and retains all the activated licenses when a newer version of SafeWebApp is installed.

Preference data used by an Android application is generally stored with the application and deleted when the application is uninstalled. If a newer version of SafeWebApp is installed without uninstalling the old version, that data is retained.

SafeWebApp Android has Backup Data and Restore Data commands on the Options menu to retain data on an internal SD Card even if SafeWebApp is uninstalled. Refer to the SafeWebApp Android QuickStart guide and download page. SafeWebApp Linux With a few exceptions, the capabilities and user experience of SafeWebApp on Linux is similar to Mac or Windows.

After downloading the SafeWebApp executable, select that file and present the Properties dialog, and set the Allow Executing file as program checkbox on the Properties dialog. Within the same folder, the SafeWebApp Libs folder contains some required libraries.

The SWA folder pictured here is optional, but can be used to deliver offline content in the same manner that folder is used on Mac or Windows.

SafeWebApp on Linux

On first launch, a dialog is presented to enter an Administor password for that computer. SafeWebApp then creates a Ticket folder and stores the active data file, SafeWebApp.data at path /var/ticket/SafeWebApp.data.

Chapter 3: Advanced Topics 3-19

Password Required on First Launch

SafeWebApp was designed for use on most Linux distributions. After downloading and unzipping the safewebapp_linux.zip file, view the ReadMe file for specific runtime requirements.

3-20 Chapter 3: Advanced Topics

Chapter 4