|
Securing server side Coldfusion code with cfcompile |
||||||||
If you ever need to protect your intellectual property, or you have suspicions that your code maybe be accessed on a server to be tampered with, then your best option is to compile your code base.
This article addresses how to use the cfcompile command, and what it actually does to your code base.
Running the cfcompile command will compile your Coldfusion code base into java bytecode. This means that the Coldfusion server engine will not have to compile it at run time.
The cfcompile command can be found in your 'cf_root/bin' directory (wherever you installed Coldfusion. To run it the syntax is as below:
2c:\inetpub\wwwroot
3c:\Inetpub\wwwroot\normal
4c:\Inetpub\wwwroot\compiled
This code runs the compile command with a deploy option, this tells the command to create a deploy set of code. Next you list your webroot directory, then the source directory and finally the destination directory.
Be careful to specify different source and destination directories, and DO NOT do this to your real code base, as it is irreversible.
@Jason, you raise an interesting point. The file size after compilation is usually a fair bit larger than the normal cf code version, I'm not sure if that has an impact on load times (probably not). I may write a test or two to create a few thousand records in a struct and loop through them, and see what the time difference is.
I'd guess that it should be quicker.
Nice tip through!
What if I'm compiling a set of files for distribution, which will be used on my different servers with different webroots?
Thats an intersting question. I'm not sure if the compile command needs to know the webroot because it is locating the compile.bat command or because it embeds a reference to the webroot location into the compiled java bytecode.
I'll try it on a small site and see if I can move it around my webroot and it still work.