CODEWITHSUNDEEP
securityjakarta-eedeploymentobfuscationproguard
Genjuro
Genjuro

Reputation: 7735

How to secure a Java EE web application code when deployed at customer's servers?

the company has created a cloud solution , but some of the customers require the app to be hosted on their infrastructure which might lead to some serious security threats such as decompiling the code. the web application uses dynamic frameworks such as spring,JPA,struts,DWR which makes the obfuscation realy difficult (i tried using Proguard).

is obfuscation the only solution ? is it even worthwhile ? any opinnion would be helpful.

Upvotes: 1

Views: 592

Answers (2)

mac
mac

Reputation: 5647

As an alternative you could deploy your service in the form of a closed virtual appliance as suggested in What are the problems of deploying an application in a virtual machine file?

Upvotes: 1

Thilo
Thilo

Reputation: 262714

The easiest (and pretty standard) thing would be to make it part of the license agreement that they may not reverse engineer or otherwise mess with your software. This assumes that you trust your business partners to keep a contract (which one could argue is a prerequisite to doing business with them in the first place).

is obfuscation the only solution ? is it even worthwhile ?

You could refuse to deploy the code to customers if you cannot trust them.

If treating your clients that way is necessary is up to you to decide. I would assume that they have better things to do than try to rip you off. But if you are so worried about it, a pure ASP model (code never leaves your servers) seems the only solution for you.

Upvotes: 2

Related Questions