有点难以用一行来解释，但我的问题本质上是这样的：
我制作了一个java小程序，我想在打包成.jar文件的网页上运行它。我可以使用
<applet archive="directory/program.jar">
假设 .jar 文件可以轻松打开并且所有类文件都已反编译，用户所要做的就是转到 www.url.com/directory /program.jar 下载我的 .jar，他们将拥有我所有的源代码:(
所以我想知道是否有一种方法可以保护我的代码/jar 不被反编译（除了混淆）或者使用某种服务器端脚本将 .jar 的内容直接从服务器提供给浏览器- 侧面位置不公开可见。
任何帮助表示赞赏。
Kind of hard to explain in one line but my problem is essentially like this:
I made a java applet that I want to run on a web page that I packaged into a .jar file. I'm able to get the applet working fine using the <applet> tag but the problem is, if the user views the page source, they will see:
<applet archive="directory/program.jar">
Assuming .jar files can be easily opened and all the class files decompiled, all the user would have to do is go to www.url.com/directory/program.jar to download my .jar and they would have all my source code :(
So I'm wondering if there is either a way to protect my code/jar from being decompiled (other than obfuscation) or to use some kind of server-side script to feed the contents of the .jar directly to the browser from a server-side location not publically visible.
Any help is appreciated.
发布评论
评论（4）
这根本上是不可能的。
Java 小程序运行客户端。
足够高级的用户可以反汇编和修改客户端上运行的任何内容。
您应该将敏感逻辑移至服务器并使用 HTTP 请求调用它（并记住用户可以使用 Fiddler）。
当您这样做时，您可能应该用 HTML 和 Javascript 替换您的小程序。
This is fundamentally impossible.
Java applets run the client.
Anything that runs on the client can be disassembled and modified by a sufficiently advanced user.
You should move your sensitive logic to the server and invoke it using HTTP requests ( and remember that the user can use Fiddler).
While you're at it, you should probably replace your applet with HTML and Javascript.
除了混淆或加密之外，无论哪种方式，浏览器都无法访问该 jar。
您也许能够创建一个在运行时加载更多功能的小程序。
Other than obfuscation or encryption, no--one way or the other, the browser will have access to the jar.
You might be able to create an applet that loads more functionality at runtime.
没有有效的方法来阻止对任何页面源代码的访问；为了使页面能够被浏览器和搜索引擎读取，源代码必须是可访问的，因此可以被查看和/或复制。这就是网络的运作方式。 HTML 作为文本文档发送并在客户端进行解释。
禁用右键单击只不过是一种烦恼，并且它在其他浏览器中偶尔会起作用。即使成功，菜单中的“查看源代码”选项也始终存在。查看者还可以使用下载工具，例如 Wget，甚至从 Google 获取页面根本无需访问您的网站即可进行缓存。
编辑：哎呀！我误解了你的问题。您应该遵循 @SLaks 的建议，“将敏感逻辑移至服务器并使用 HTTP 请求调用 ot（并记住用户可以使用 Fiddler）。”
There is no effective way to block access to the source code of any page; for the page to be readable by browsers and search engines, the source code has to be accessible, and therefore can be viewed and/or copied. That's just how the web works. HTML is sent as a text document and interpreted client-side.
Disabling the right-click is little more than an annoyance, and it works sporadically in alternative browsers. Even if you succeed, the View Source option in the menu is always present. The viewer could also use a download tool such as Wget, or even get the page from the Google cache without visiting your site at all.
Edit: Oops! I misunderstood your question. You should follow @SLaks advice and "move your sensitive logic to the server and invoke ot using HTTP requests ( and remember that the user can use Fiddler)."
虽然量子力学确实统治着宇宙，但它们对你的代码的控制却没有你想象的那么大。您不能既将代码部署到客户端浏览器又不将代码部署到客户端浏览器。您可以选择执行其中一项或另一项。
您可以通过将
.jar文件定位到 WAR 文件中的 WEB-INF 目录下来防止直接浏览该文件。这也会阻止一旦 jar 位于 WEB-INF 目录下，您将需要一些东西来将资源提供给客户端浏览器； Spring 资源 servlet 对此很有用（如果您使用 Java 和 Spring）。我相信还有其他类似的工具存在。使用 Sprint 资源 servlet，您可以使用如下所示的内容来部署 applet：
如果您编写自己的资源分配器，则可以添加安全性以使其更难获取 jar 文件；也许可以在您的请求中添加一个标头，例如
IRGud:，并使任何没有该标头（或标头中可接受的内容）的请求失败。While quantum mechanics do rule the universe, they have less of a grip on your code than you might suspect. You cannot both deploy code to the client browser and not deploy code to the client browser. You have the option of doing one or the other.
You can prevent direct browsing to your
.jarfile by locating it beneath the WEB-INF directory in your WAR file. This will also prevent<applet archive="directory/program.jar">from working.Once the jar is beneath the WEB-INF directory you will need something to feed the resource to the client browser; the Spring resources servlet is good for this (If you are using Java and Spring). I feel confident that other such tools exist. With the Sprint resours servlet, your would deploy your applet with something like this:
<applet archive="resource/program.jar".If you write your own resource distributor, you can add security to make it harder to get the jar file; perhaps add a header to your requests like
IRGud: <user_id here>and fail any request that does not have that header (or acceptable contents in the header).