Protect Tomcat Web App

Video Tutorial

Get Started

If you haven’t read the get started article, please read it first, it described the basic structure and concepts of Protector4J.

GUI Tool

Execute protector4j-ui[.exe] in the folder of Protector4J, you will see the interface below

Login

If you have got the license, you can click the login button on the top-right corner and type your account information. Although, without the license, you can still try this tool.

Choose app type

Click the “Tomcat Application” button on the app types page.

Choose war/jar files to protect

Choose the war/jar files to protect, you can add single or multi war/jar files here.

Options

Protect all classes

if this option is selected, all the classes will be encrypted

Protect the specified classes

If this option is selected, you can choose which classes to encrypt in the next step

Protect inner jars

If this option is checked, the classes in the inner jars will be encrypted too.

Choose classes to protect

If you selected “Protect the specified classes”, you should type the classes that need to protect here manually, but also the classes need to exclude from the encryption

You can input the full class name like:

1

io.vlinx.swing.MainWindow

If you want to encrypt all the classes in the package, you can input a wildcard case like:

1

io.vlinx.swing.*

One * means all the classes in the package, but exclude the classes in sub packages

if you want to encrypt all the classes in the package including the classes in sub packages, please use the wildcard case like:

1

io.vlinx.swing.**

The class names or the package names above apply to all jar files, just like the classpath. We have the class information in the jars mixed together, and any classes in any jar files that meet the conditions will be encrypted or excluded, if you selected “Protect inner jars”, the classes in the inner jars will be procesed too.

Although it needs to type the classes information manually, but we provide the class info tree on the right, you can view the struct there, and there is a context menu that could help you to edit the class list.

Output options

On this page, you can specify the Java version, the Tomcat version, the output folder and target platforms. After this is done, click the “Next” button on the bottom, it will start the encryption task.

KeySeed

The seed to generate the encryption key, the same key seed will generate the same encryption key. If you want to jars generated from diffrent encryption task can be used together, you can input the same keySeed. This feature is only valid for licensed user.

Encryption process

It will take some time to finish the encryption process. After it is done, you can check the result in the output folder.

Check the result

After the encryption process complete, please go to the output folder to check the result. There is a tomcat folder with the web apps and the custom java runtime in it.

Run the encrypted app

Please go to the tomcat’s bin directory, and use the startup.sh or startup.bat shell script to launch it.

On Linux and macOS

1

./startup.sh

On Windows

1

startup.bat

Every encryption task will request a new and unique key. The files encrypted in different task can not be used together unless providing the key seed.

Create Windows Service

If you need to create the windows service, please refer to here

CLI Tool

The configuration of task file

It needs to specify a task file as an argument to the command-line tool.

Please find the task.tomcat.yml in the task-templates directory, copy and modify a new one.

1
2
3
4
5
6
7
8
9
10
11
12
13
14

email: ''
password: ''
jarsPath: []
protectAll: false
protectInnerJars: false
classesToProtect: []
exclude: []
outputFolder: ''
tempFolder: ''
javaVersion: ''
tomcatVersion: ''
includeJavaFX: false
keySeed: ''
targetPlatforms: []

The account information

If you have purchased this tool, you would have got your account information including the email address and the password for the license. Please type them in the appropriate fields, the value of the password field should be the md5 value of the password, not the password itself. or you can leave the email and the password fields empty, just have a try.

1
2

email: account-email
password: md5-of-password

Specify the jars and the classes need to be encrypted.

jarsPath

The jarsPath field is an array, which you could specify one or multi jar/war files that need to be processed in the encryption work.

1

jarsPath: [jar-path1,jar-path2,...]

or

1
2
3

jarsPath: 
- jar-path1
- jar-path2

protectAll

If this value is true, all the classes in the jar will be encrypted.

protectInnerJars

If this value is true, the classes in the inner jars will be encrypted too.

classesToProtect

In this field, you can specify the classes that need to encrypt. it can be a full class name, or wildcard case ones

1

classesToProtect: [vlinx.test.TestClass1, vlinx.test.pack1.*, vlinx.test.pack1.**]

or

1
2
3
4

classesToProtect: 
- vlinx.test.TestClass1
- vlinx.test.pack1.*
- vlinx.test.pack1.**

* means all the classes in the package, but exclude the classes in the sub package

** means all the classes in the package including the classes in the sub package.

If the protectAll is true, this field will be ignored.

if you are using the version before 1.8.0, please add WEB-INF.classes prefix for each item for the classes in WEB-INF/classes, like WEB-INF.classes.vlinx.test.TestClass1

exclude

In this field, you can specify the classes to exclude from encryption, the format is the same as classesToProtect field.

javaVersion

The java versions supported now are Java 8 and Java 11, you can type “java-8” for Java 8 and type “java-11” for Java 11

tomcatVersion

The tomcat versions supported now are Tomcat 8.5 and Tomcat 9.0. You can type “tomcat-8.5” for Tomcat 8.5, “tomcat-9” for Tomcat 9.0

tempFolder

The temp folder for the files generated during the encryption process, after the task completed, the files in the temp folder will be cleaned up.

outputFolder

The encrypted app and the custom Java runtime will be placed into the output folder.

includeJavaFX

Whether include the JavaFX framework

keySeed

The seed to generate the encryption key, the same key seed will generate the same encryption key. If you want to jars generated from diffrent encryption task can be used together, you can input the same keySeed. This feature is only valid for licensed user.

targetPlatforms

This field is an array, the available values are [linux64, win64, mac, linux32, win32], you can set one or multi target platforms according to the requirement. Or leave it empty, if you just want to generate the app for current platform.

On windows, currently only supports win64 and win32 as the target platforms.

1

targetPlatforms: [linux64, win64, mac, linux32, win32]

or

1
2
3
4
5
6

targetPlatforms:
- linux64
- win64
- mac
- linux32
- win32

Execute the encryption process

Go to the folder of Protector4J and execute the command below to run the encryption process

On Linux or macOS

1

./protector4j -t tomcat -f path-of-task-file

On Windows

1

protector4j -t tomcat -f path-of-task-file

-t task type

-f task file

You can execute protector4j --help to see the detail arguments.

Check the result

After the encryption process complete, please go to the output folder to check the result. There is a tomcat folder with the web apps and the custom java runtime in it.

Run the encrypted app

Please go to the tomcat’s bin directory, and use the startup.sh or startup.bat to launch it.

For Linux and macOS

1

./startup.sh

For Windows

1

startup.bat

Every encryption task will request a new and unique key. The files encrypted in different task can not be used together unless providing the key seed.

Create Windows Service

If you need to create the windows service, please refer to here

Create Windows Service

Create service

There is a “create-service.bat” script in tomcat/bin folder, if you need to create the windows service, just cd to the tomcat/bin folder then execute

1

create-service.bat your-service-name

Please execute this script as Administrator, it will create a Windows service then start it

Delete service

If you need to delete the service, cd to tomcat/bin folder too, then execute

1

delete-service.bat your-service-name

this script should run with Administrator too