I have a web application running on Glassfish 3.1.2 servlet container and I need a way to protect the compiled java classes. I have tried to obfuscate the source code but it didn't work.

The project contains a lot of classes using java reflection, annotations, generics and some other things that makes the obfuscation process very difficult. Does anyone know a way to restrict the access to the .war and the .class files inside the glassfish folder? Did someone already have this problem and manage to find a workable solution?

closed as not a real question by NULLZ, Adi, TildalWave, Mark Davidson, Gilles May 24 '13 at 12:56

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center. If this question can be reworded to fit the rules in the help center, please edit the question.


What you're asking to do is trying to do is impossible. If the machine can work out how to execute an application, so can a human.

Now, your source code absolutely must be readable for maintenance and audit purposes, if security really is one of your top concerns.

As for preventing malicious entities reverse engineering your WAR, you have a few options, some more radical.

  1. Change your delivery method to software-as-a-service. The hostile entities never see your WAR, but you do take on additional risks, in that your company will be the one attacked now, not your customers. You are also centralising your customer's data, so a breach of one customer in a badly designed system will affect all customers.

  2. Use some form of license management inside of your application. Make it clear that anyone circumventing the restrictions will suffer at the hands of your legal department. The tricky bit with this is detecting when someone attempts to reverse engineer your WAR. Dropping random self-integrity checks into the source code that some how phone home if they're failed would help, but you're on shaky grounds -- attackers can remove them.

  3. Go Open Source. Seriously, go open source and position yourself as a consultant and SaaS as above. There are serious benefits to this, for example Linus' Law may come into play. However, if your algorithm is a trade secret, or your security relies on Kerckhoffs's Principle, this may be a bad idea. Obviously, you'll need to re-engineer your company's current cash flow plans. There's also the different models to this, for example, free commercial editions and professional editions, or pay-for plugins.

Not the answer you're looking for? Browse other questions tagged or ask your own question.