Are JSP applications Secure ????

Question

Hi all,
We develop software based on the J2EE, and the products we develop come with a licensing, so even though we plan to give the entire source code to the client, for more number of user licenses the client has to contact us. In such a scenario, and development being based on JSP core, and we giving the code to the client, it is highly insecure that the code can be easily De-compiled and the code which handles the licensing stuff be commented out or removed. Under such circumstances, how are we to build secure JSP applications. Is there any other alternative to this apart from code obfuscation ? Can code obfuscation be done to JSP pages too, and how secure is it going to be since ultimately i can get the code from the servlet inside the work folder of the servlet / jsp container ?
Can anyone throw some light on this ?
Cheers,
-Prashant.

Answer 1

Hi Cetin & Grant,
I do agree with you both, but dont we as developers
anticipate such things and plan for it well ahead. If
that is the case then if it is going to be a crime
free world out there then why do we need all these
security & protection mechanisms. I guess my message
was misunderstood or rather what I wanted to say wasnt
properly given in words ?No, I understood - I just disagree that there's a Java-specific problem here.
Let me restate what I actually wanted to know, let us
take for example an application created using
Microsoft technologies, as I am going to distribute it
in binary form or an executable form, the person who
buys it from me cannot re-engineer it that easily as
compared to a java-based application. This is due to
the fact that De-compilers are very easily available
nowadays which can easily help in re-engineering,
under such circumstances as Java Developers is it not
our duty to find out alternate measures to handle such
occurances.The key disagreement I have with you, I guess, centers on the phrase "distribute it in binary form or an executable form, the person who buys it from me cannot re-engineer it that easily". I will point out that (speaking of Microsoft products) Microsoft Office and Windows itself are quite possibly the most-pirated applications in existence - and neither is written in Java. Both are typically available in pirated versions within days of being released (sometimes even before release!).
Piracy via decompiling has been happening for decades. I have, in fact, watched someone break a license-based protection scheme on a compiled binary in about 30 minutes, using nothing more than a debugger and a hex-editor.
You should probably obfuscate your code, yes. You should probably have a licensing scheme, yes. You should almost certainly not spend very many machine- or thought-cycles on it - the best you can do is deter the "casual thief". And it's not a problem caused by, nor even exacerbated much by, Java. Some very bright people in our industry have spent a lot of time working on preventing piracy - and we've failed.
Am I missing anything here. Does Sun provide any
explanation to this, like kind of using code
obfuscators etc.Obfuscation helps, yes. Try Google and search for "java obfuscator"; there are a number of them out there.
That you're planning on giving your source to your customers makes the problem even more exciting. My take would be, don't spend more than a week on designing and implementing whatever scheme you come up with. That should be sufficient to protect your product from most customers (because most customers are, in fact, honest!) Sprinkle copyright notices liberally throughtout your code, and in the bytecode as well (think compiled-in "public static final String copyright = "blah blah blah 2003";"). Make sure your license agreement mentions draconic penalties for theft. Then, make sure that your product delivers good value for the dollar, and is dead easy to install and run legally. This is about the best you can do.
Your stuff will be used illegally - but the goal is to keep that down to levels that are manageable (i.e., profitable for you and your company).
Good luck!
Grant