Protect Spring Boot and Spring Framework Applications – Preemptive Support Center

PreEmptive Protection™ DashO™ protects both Spring Boot and Spring Framework projects. Spring relies on annotations, naming conventions, and XML configuration to find components at runtime, so careless obfuscation breaks your app. DashO reads your Spring configuration and sets up the exclusions and entry points your project needs, so you get stronger protection against reverse engineering without changing how your app behaves.

Protect a Spring Boot Project

How DashO Reads Spring Boot Packages

DashO reads the Spring Boot MANIFEST.MF file to gather information about your project. It uses the following fields automatically:

Manifest field	How DashO treats it	Example (WAR)	Example (JAR)
`Spring-Boot-Classes`	Classes in this folder are the input classes to protect.	`WEB-INF/classes/`	`BOOT-INF/classes/`
`Spring-Boot-Lib`	Libraries in this folder are support libraries.	`WEB-INF/lib/`	`BOOT-INF/lib/`
`Start-Class`	This package is an entry point for the project.	—	—

Why Spring Boot Needs Exclusions

Spring Boot is a convention-based framework that relies on annotations. It names annotated components discovered at runtime, REST endpoints, and database models after their class, method, and field names. Renaming these elements changes your app's runtime behavior. In-app protection makes your software harder to reverse-engineer, but it shouldn't change how the software runs. To keep your app working, exclude these components from Renaming, Removal, or both.

Configure a Spring Boot Project with the Project Wizard

The Project Wizard configures all the required exclusions and settings for you.

Go to File > Project Wizard.
Select the Web project type.
Enter your Spring Boot JAR or WAR file as the input.
Review the settings the wizard configures. For more information, see Spring Boot Settings the Wizard Configures.
Save your project and build it to apply protection.

Warning: Use the Maintain hierarchy Package Renaming setting for Spring Boot projects. Other package renaming settings can break the Spring Boot component scan at runtime.

Spring Boot Settings the Wizard Configures

When the Project Wizard finds a Spring Boot JAR or WAR file, it configures the following:

Setting	Configuration
Input handler type	Sets the input to the Spring Boot handler type.
Entry points	Adds the important Spring Boot annotations as entry points, such as `org.springframework.` packages and `javax.persistence.` annotations.
Removal	Enables Removal and excludes the Spring Boot packages and other important packages.
Renaming	Enables Renaming with the Maintain hierarchy Package Renaming setting, and excludes the Spring Boot packages and other important packages.
Make Synthetic	Enables Make Synthetic and excludes the Spring Boot packages and other important packages.

Protect a Spring Framework Project

How the Spring Bean Special Class Works

During processing, DashO follows these elements of each Spring Bean special class to determine unused methods:

Property methods (get*(), is*(), and set*(*))
Public constructors
Configured entry points

You choose whether DashO renames each of the following: the class, configured entry points, property methods, and non-property methods.

How DashO Updates Spring XML Files

DashO scans your Spring XML files during each build. If DashO renames a Java class, it updates the XML to match:

Direct class references
Class names listed in parameters or argument types
Bean property names and entry point method names, if DashO renamed them
Property names and method names in abstract beans, such as bean definitions without classes. DashO assumes these abstract beans relate to the renamed beans.

Configure a Spring Framework Project with the New Project Wizard

For the best results, start your project with the New Project Wizard, then adjust individual special classes as needed.

Go to File > Project Wizard.
Select your project type and enter your application.
Let the wizard scan your Spring XML files. It identifies bean class references and configures Spring Bean special classes. See What the Wizard Does with Bean Definitions.
Review the Spring Bean special classes the wizard creates, and adjust them as needed.
Manually add entry points the wizard doesn't detect.
Save your project and build it to apply protection.

What the Wizard Does with Bean Definitions

When the New Project Wizard finds a bean definition in a Spring XML file, it does the following:

XML element or attribute	Wizard action
`class`	Creates a Spring Bean special class for the class.
`init-method`, `destroy-method`	Adds them to the special class as entry points.
`default-init-method`, `default-destroy-method`	Adds them as entry points if the bean has no `init-method` or `destroy-method` attribute, respectively.
`factory-method` (directly on the bean)	Adds it to the special class as an entry point.
`lookup-method`, `replaced-method`	Adds them to the special class as entry points.
`util:constant static-field`, `org.springframework.beans.factory.config.FieldRetrievingFactoryBean`	Looks for constant values these reference.

Limitations and Troubleshooting

Scenario	What to do
You use the `factory-bean` attribute.	Manually add the corresponding `factory-method` as an entry point on the appropriate class. The wizard doesn't add it for you.
You use `replaced-method`.	Specify the method signature with `arg-type` elements so DashO identifies the correct method after renaming.
You use `FieldRetrievingFactoryBean` with the `targetObject` attribute.	DashO doesn't support the `targetObject` attribute.
Your Spring Boot app fails at runtime after protection.	Confirm that Renaming uses the Maintain hierarchy Package Renaming setting, and that annotated components are excluded from Renaming and Removal.