Protecting Applications with WAR and EAR Packaging and Sourceless Deployment

The J2EE specification defines the constituents that comprise a web application. This is a collection (in J2EE terminology) of servlets, JSP files, Java classes, HTML files, images, and other content. The specification defines, specifically, XML deployment descriptors and a directory structure so you can port WAR files between J2EE application servers. The EAR file is a superset of the WAR file and defines an additional collection of J2EE assets. These are (again, in J2EE terminology) EJBs, data sources, JNDI contexts, and WAR files. An EAR file can contain one or more WAR files. Luckily for our purposes, this discussion is largely academic.

ColdFusion MX 7 (all editions) automates the task of creating J2EE archives. From the ColdFusion Administrator inside any edition of ColdFusion MX 7, you can create a WAR or EAR file from a specified set of application directories. Whether your choose EAR or WAR is entirely driven by the deployment environment (for example, Tomcat is a servlet engine and only accepts WAR files). To deploy a WAR/EAR, however, you need an Enterprise license.

One of the new options we developed for ColdFusion MX 7 is the ability to write a ColdFusion application and deploy it without distributing the source code when you create an EAR or WAR file. If you select this option, called the Sourceless Deployment option, the CFML files that comprise your ColdFusion application are excluded from the archive, but your application will still run (the package contains only Java bytecode in this instance). The EAR or WAR package option protects your intellectual property more than previously possible, in ColdFusion. Humans cannot read the Java bytecode. And even when a user decompiles the bytecode, it unpacks to Java bytecode, which is still very different from CFML.

We created this option by compiling the ColdFusion files into Java bytecode. If you expand the archive, you can still see your application’s directory structure and files (images, style sheets, and so forth), even if users cannot access the files that comprise your application. However, if a user deploys the archive and tries to open any CFML files, he or she will see Java bytecode, not CFML. Give it a try, you’ll see bytecode completely obscures your application logic.

Figure 4. Creating a WAR package to deploy on another J2EE application server

To add a new archive definition and create an archive file:

1. Open the ColdFusion MX Administrator.
2. Specify a unique name for the archive file (no extension) in the Archive Name field.
3. Click Add. The Add New Archive screen appears.
4. On the Add New Archive screen, specify archive settings such as: Include CFML Source, Include ColdFusion MX Administrator, Data Sources (to include), and more.
5. Click Create. ColdFusion creates an EAR or WAR file in the specified application distribution directory.

In this article, you have learned the basics of clustering and instance management for high availability with the Enterprise Manager, available in ColdFusion MX 7 Enterprise edition. ColdFusion MX 7 simplifies the process for setting up and managing clustering, load balancing, and failovers. This article also introduced sourceless deployment packaging options. We hope you find the Enterprise Management feature a powerful and enjoyable experience.

Page 6 of 6

Previous Page