This section describes the basics of security for applications deployed through Java Web Start and includes:
Applications launched with Java Web Start are, by default, run in a restricted environment, known as a sandbox. In this sandbox, Java Web Start:Unsigned JAR files launched by Java Web Start remain in this sandbox, meaning they cannot access local files or the network.
- Protects users against malicious code that could affect local files
- Protects enterprises against code that could attempt to access or destroy data on networks
Java Web Start supports signed JAR files so that your application can work outside of the sandbox described above, so that the application can access local files and the network.Java Web Start verifies that the contents of the JAR file have not changed since it was signed. If verification of a digital signature fails, Java Web Start does not run the application.
When the user first runs an application as a signed JAR file, Java Web Start opens a dialog box displaying the application's origin based on the signer's certificate. The user can then make an informed decision regarding running the application.
For more information, see the Signing and Verifying JAR Files section.
For a signed JAR file to have access to the local file system and network, you must specify security settings in the JNLP file. Thesecurityelement contains security settings for the application.The following example provides the application with complete access to the client system if all its JAR files are signed:
<security> <all-permissions/> </security>
Java Web Start dynamically imports certificates as browsers typically do. To do this, Java Web Start sets its ownhttpshandler, using thejava.protocol.handler.pkgssystem properties, to initialize defaults for theSSLSocketFactoryandHostnameVerifier. It sets the defaults with the methodsHttpsURLConnection.setDefaultSSLSocketFactoryandHttpsURLConnection.setDefaultHostnameVerifier.If your application uses these two methods, ensure that they are invoked after the Java Web Start initializes the
httpshandler, otherwise your custom handler will be replaced by the Java Web Start default handler.You can ensure that your own customized
SSLSocketFactoryandHostnameVerifiterare used by doing one of the following:
- Install your own
httpshandler, to replace the Java Web Starthttpshandler. For more information, see the document A New Era for Java Protocol Handlers .- In your application, invoke
HttpsURLConnection.setDefaultSSLSocketFactoryorHttpsURLConnection.setDefaultHostnameVerifieronly after the firsthttps URLobject is created, which executes the Java Web Starthttpshandler initialization code first.