I am a beginner Java programmer, and have tried searching for a way to set up a login system with my Java application. The application is a game and I do not want people to just upload it to a website so others can down load and play. I want to use something like MySQL to make the user authenticate in order to use the application. Does anyone have a suggestion?
- Anybody can ask a question
- Anybody can answer
- The best answers are voted up and rise to the top
In short, don't bother.
A runnable JAR can easily be decompiled back into the Java and the login page would be circumvented rather easily. If the game is in the form of a Java applet, once a person gets past the login page, the applet can be downloaded and distributed with no problem.
Developers have been trying for years to stop people from using their software. To the best of my knowledge, there is no way to stop people from stealing your software. While you can go the route of security through obscurity, this is not in fact security, only a deterrent to the less experienced.
You may be able to stop some people from playing without your permission, but the client will need the code, even if in a binary form, to play the game, and therefore can access and modify it at will.
One approach to this problem would be the use of a web service which would authenticate the user's credentials before allowing further use of the application or game. This would mean that the game would have to have internet access, and that you have a server on which you could host the authentication service.
There's a lot to learn to make this work. First, you'll need to know how to build a web service and how to call one. Presumably, the service would have to send a token back to the game if the credentials are valid--you'd need to use encryption to make sure that the token itself is valid and not a spoof. That means you probably need to learn something about encryption with public and private keys. You'll also need to integrate the security checks throughout your application.
In the end, you're still not guaranteed a 100% protected application, but you can limit abuse to the real die-hard hackers.