Question: I am relatively new to MVC, and have just come across some pre-existing code. 

We have a UserService, which mainly contains CRUD operations, and perhaps, one or two business logic operations - all needed by our controllers. It encapsulates the context and the Membership. 

I was about to implement the ResetPassword operations, but I was not sure where to implement it; whether to implement it at the UserService or at the User Entity. 

---

*UserService*

```
bool ResetPassword(string username, string newPassword);

```

This would lead to my controller being:

```
ActionResult ResetPassword(string username, string newPassword)
{
  userService.ResetPassword(username, newPassword);
}

```

vs

*User*

```
bool ResetPassword(string newPassword)

```

This would lead to my controller being:

```
ActionResult ResetPassword(string username, string newPassword)
{
  var user = userService.GetUser(username);
  user.ResetPassword(newPassword);
}

```

Which approach is recommended?

Answer: 
You should consider using a License management api to do the same, which will give u both security and capability to change License pre/post installations. 

It is not advisable to build adhoc licensing capabilty, take a look at [License3j](http://projects.verhas.com/com.verhas.licensor/license3j/license3j/) and [TrueLicense](http://truelicense.java.net), they are both free and can help you gain perspective or better fulfil your requirement
You could try and encode that in a file. I assume each user has an own installation/version of the application, right? I further assume the application should not need to check some web resource. Thus you need to implement that in a file.

However, you should encrypt that file and put the salt and key somewhere in the code where they can't easily be decompiled. Additionally create a hash to check for modifications of the file. That hash could be based on the application's size or something else.

Please note that there's no 100% security and any hacker could still crack your application. But in that case this would need some form of criminal energy not commonly present in the business world.