How can I protect/obfuscate/etc an ASP.NET MVC app's source code when deployed?

views:

231

answers:

+1 Q:

How can I protect/obfuscate/etc an ASP.NET MVC app's source code when deployed?

I have had good experiences recently developing with ASP.NET MVC and am considering whether or not to use it for a project coming up at work. One important consideration though: they sell source code licenses separately as a rule, and it's the kind of application we can't realistically tie to our own hosting without cutting off a large chunk of the potential market.

Is it possible to distribute an ASP.NET MVC application without source code? Or is there a fairly effective (obviously won't be foolproof but it's at least not a "steal me" welcome mat) and safe tool or method for obfuscating MVC applications? I tried a couple obfuscators that supposedly work with ASP.NET but they broke the application because of MVC's reliance on specific file/directory names.

+4 A:

1) Don't bother. How likely is it really that someone will try to steal your code?

2) If you really must, I believe Crypto Obfuscator can obfuscate ASP.NET MVC.

Iain Galloway 2010-01-27 22:51:39

Yes, I find the assembly watermarking a particularly good feature. If somebody does find out a way to get it (an inevitability, to be sure), then this feature allows you to trace them if they subsequently redistribute it.

Dan Atkinson 2010-01-27 23:07:40

The issue isn't so much "stealing" source code. The application in question is the kind which will be licensed relatively cheap with the assumption that most clients will want it customised in some way and a lot of the costs of development can be recouped there.

FerretallicA 2010-01-28 00:32:37

@FerretallicA: Absolutely. I'm aware of the business model, but you didn't answer my question. How likely is it *really*? If I was your client, I'd pay you to customise your application (or for the source code) rather than mess around with decompiling/recompiling - particularly when that would be against my licence terms *anyway*. Your implication is that simply compiling your app and licensing it on the condition that the user doesn't modify it isn't enough. Is your target market really a market that would be prepared to violate their licence terms so blithely?

Iain Galloway 2010-01-28 09:49:57

I did answer your question as far as relevant. I'm not getting into a discussion about the relevance of securing code as it's missing the point entirely and in any event is going to be an almost entirely subjective discussion.

FerretallicA 2010-02-07 23:01:41

Fair enough. Did you try Crypto Obfuscator yet?

Iain Galloway 2010-02-08 09:02:40

Answer as posted by chobo in comments:

When you mean source code do you mean just like the controllers and models code? Or are you talking about everything including views? Since if your just worried about your cs code then you can just publish your application. That will make a .dll for all your controllers and model code. So they won't be able to look into the .dll and see the code that makes it work. View though won't be put in the .dll but anyone can just go to your site and get the html code by looking at view source.

It looks like you can't really do the same to Views but the controllers, model logic etc can all be distributed solely as a DLL and obfuscated with pretty much any .Net compatible obfuscator.

FerretallicA 2010-02-23 00:08:36

This is wrong - .NET dlls are compiled to their JIT bytecodes, which is trivial to disassemble and view through reflector. If you're really worried about clients stealing/modifying your source code, it needs to be obfuscated, as Iain mentioned.

Tanzelax 2010-02-23 00:14:07

1) If you really want, you *can* put views into a dll. See e.g. http://stackoverflow.com/questions/236972/using-virtualpathprovider-to-load-asp-net-mvc-views-from-dlls 2) Since ASP.NET MVC relies on method names at runtime to perform routing, in my experience most .NET obfuscators can cause problems.

Iain Galloway 2010-02-23 08:46:41

ansaurus

tags:

views:

answers:

How can I protect/obfuscate/etc an ASP.NET MVC app's source code when deployed?

related questions