Is it worth to obfuscate java web application? [closed]

Question

Is it worth to obfuscate java web application? and why?

Answer 1

No. The code is stored on the server where external users (hopefully) don't have access to it. You may want to obfuscate the JavaScript if you feel it's worth the (minimal) IP protection.

The best thing is so make sure your server security is up to scratch and you don't have open access to your application directories (which shouldn't happen anyway).

Answer 2

IMO, no.

There are two main use-cases for obfuscation:

1. to protect access control "secrets" (e.g. passwords) embedded in the code, and
2. to protect against someone stealing your "intellectual property".

The problem is that obfuscation only foils half-hearted attempts at reverse engineering. A serious attempt will always succeed. It is really not that hard to decompile an obfuscated JAR file, and there are lots of tools around for doing it.

For the use-cases above, better alternatives to obfuscation are:

1. just don't embed secrets in the code, and
2. one or both of the following:
   • secure your webservers so that hackers cannot get at the code, and
   • don't ship the code that you consider to be valuable IP, or if you do, then only ship code to people who have signed a legally binding contract / license agreement that guards your IP rights.