Question: I am relatively new to MVC, and have just come across some pre-existing code. 

We have a UserService, which mainly contains CRUD operations, and perhaps, one or two business logic operations - all needed by our controllers. It encapsulates the context and the Membership. 

I was about to implement the ResetPassword operations, but I was not sure where to implement it; whether to implement it at the UserService or at the User Entity. 

---

*UserService*

```
bool ResetPassword(string username, string newPassword);

```

This would lead to my controller being:

```
ActionResult ResetPassword(string username, string newPassword)
{
  userService.ResetPassword(username, newPassword);
}

```

vs

*User*

```
bool ResetPassword(string newPassword)

```

This would lead to my controller being:

```
ActionResult ResetPassword(string username, string newPassword)
{
  var user = userService.GetUser(username);
  user.ResetPassword(newPassword);
}

```

Which approach is recommended?

Answer: 
You could try and encode that in a file. I assume each user has an own installation/version of the application, right? I further assume the application should not need to check some web resource. Thus you need to implement that in a file.

However, you should encrypt that file and put the salt and key somewhere in the code where they can't easily be decompiled. Additionally create a hash to check for modifications of the file. That hash could be based on the application's size or something else.

Please note that there's no 100% security and any hacker could still crack your application. But in that case this would need some form of criminal energy not commonly present in the business world.
This is very open ended - it really depends on what you're trying to achieve, and what you mean by a feature.

One approach is to use a plugin based architecture. e.g. you have an interface

```
public interface Feature {}

```

and provide each of your ten features as implementors of this interface. Then have some method which runs at application start which looks for `Feature` subclasses on the classpath.

You can control which features a client has by including only the relevant features on the classpath, e.g. using maven.