How do I secure my code written in coldfusion?
I have a website that is written mostly in coldfusion. Right now I prevent others from copying my code by hosting sites on a server that I control. If I set up a website for someone on a server that I don't control how can I secure my code to prevent someone from copying and installing it somewhere else?
What you are asking is common for mobile apps as an example because when you place your code in an app store and it gets downloaded, it is no different than placing your CF code on somebody else's server. A quick search brings up one such company that does this https://www.guardsquare.com/ I also found cfencode https://wiki.hostek.com/How_to_Encrypt_or_Compile_ColdFusion_Files and another quick search shows how to decrypt https://computerramblings.wordpress.com/2014/02/27/decrypting-coldfusion-files-encrypted-with-adobe-cfencode-exe-utility/
A good contract is probably going to be more important.
Keep in mind that your code is not going to be very easy for somebody else to just take apart and use somewhere else.
A safeguard you can incorporate is to register the server that the code is installed on. You can run serverside code to grab the machine information and other properties to send as a hash to your server. That can in part protect your code from being moved or copied. You can build in a key that changes every hour or day and your CF code checks the key with each task.You can use an encrypted exe file to generate the key. If you do anything like that, you will want to update your contract/terms.
A good contract is probably going to be more important.
Keep in mind that your code is not going to be very easy for somebody else to just take apart and use somewhere else.
A safeguard you can incorporate is to register the server that the code is installed on. You can run serverside code to grab the machine information and other properties to send as a hash to your server. That can in part protect your code from being moved or copied. You can build in a key that changes every hour or day and your CF code checks the key with each task.You can use an encrypted exe file to generate the key. If you do anything like that, you will want to update your contract/terms.
ASKER
My understanding is that cfencode isn't really an option since it is easy to decrypt. The option that you mention regarding registering the server, running serverside code, etc. sounds interesting but I have no idea of how I would do this. Are there any examples for this?
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
This means you + the hosting/provisioning company are only people with site access.