Java Security & Applets
This web page has information on Java Security.
- General Information.
- Web browsers allow downloaded Java applets to execute within a limited
context called the "applet sandbox". Applet's are not
allowed to access your local file system or network connections unless the applet is given
permission by a system administrator who creates a digital signature (ie:
signed applet aka trusted applet).
- There have been major changes between Security in JDK 1.1 and
Java 2 JDK 1.2. JDK 1.3 & JDK 1.2 seems to be identical.
- On version 1.1 of the Java platform, a trusted applet has the same
freedom to perform operations as a local application. On version 1.2
of the platform, a trusted applet would have freedoms as specified
by the policy file in force.
- JDK1.1 - "trusted applets" have permission like local
- JDK 1.2 use policy files for permissions.
- JDK 1.3 use policy files for permissions.
- JDK 1.1 Trusted Applets
Summary of process
- Signer signs the JAR file using a private key (use JavaKey.exe)
- You obtain a digital certificate from a "certification
authority" - companies that specializing in digital security
- The Public key is placed in the JAR file along with a digital
- JDK 1.2/1.3 Trusted Applets - depending on the browsers implementation of Java you will probably
need to load the Java Plug-in to be able to use JDK 1.2 policy files (ie:
IE 5 & NS 4). Netscape 6 implements the JDK 1.2 without a Java
- Digital Certificates are not needed. (use keytool.exe &
- Use PolicyTool.exe to create the policy files with the neccessary
- In Java2 JDK1.2, reading or writing a file, are not permitted for
applets unless explicitly allowed by a permission in a policy file.
JDK 1.1 is much harder to implement because your Applet must be digital
signed to be trusted. With JDK 1.2 you can also
apply security constraints to Java applications.
- The Java™ 2 Standard Edition
Runtime Environment includes the Java Plug-In.
- With Java 2, you can configure the Java Plug-In via the control
panel's icon "Java Plug-In".
- You can optionally sign a JAR file with your electronic
"signature." Users who verify your signature can grant your
JAR-bundled software security privileges that it wouldn't ordinarily
have. Conversely, you can verify the signatures of signed JAR files that
you want to use.
- Good Books
- Java in a Nutshell by O'Reilly 3rd Edition - CH 5 - Java Security.
- Java Examples in a Nutshell by O'Reilly 2nd Edition - CH 6 Security
- Java Tooldocs
- Java Plug-in (Windows & MAC)
- Sun's Java Plugin allows access to the latest JRE (Java Runtime
Environment) instead of your browsers JRE. At the bottom of the
web page is some links to examples that will test your install.
- Download JRE - Installs the Java Plugin.
- Download HTML Converter - Converts the HTML <applet> tags to
work with the Java plugin.
- MAC JRE.
- Resources on using Java Plugin
- Tutorial for JDK1.2 Java Applets & Local File Systems
- Tutorial for JDK1.1 Java Applets & Local File Systems
- Sun's example and instructions on how to create a Signed Applet so
that the Applet Security Manager will allow your applet to access the
local file system using JDK1.1. Example uses the Appletviewer.
In a real solution you will still need the Java Plug-In.
- Sun's Forums: http://forum.java.sun.com
- Applet Security Manager
- MAC - Examples of Applets & local file systems
Trusted Applets (IE & Netscape)
Since the browser implements the security model you need to study each
- IE (Signing a CAB file)
- IE's Java Security Overview.
- Microsoft SDK for Java. For application an applet developers.
- HOWTO: Making your Java Code Trusted in Internet Explorer
- INFO: How does the VM search for Java Classes?
- Make an Applet trusted by placing the file in a signed cabinet file,
or by placing the class in the classpath
- CABARC.exe - Microsoft's utility to create CAB files.
Dubuild.exe utility in the SDK for Java
You sign a CAB using the Signcode.exe utility in the SDK
- You can sign a CAB file by using the Authenticode mechanism.
- For your classes to run with permissions above the sandbox level, the classes must be delivered to the client computer
inside a signed cabinet (CAB) file. When you sign the CAB file, you also must specify the permissions that the contained
classes require. You must sign your cabinet file with the appropriate permissions. -Low or
-LowX permission will guarantee you have appropriate access or you may sign with the appropriate granular permissions
using an ini file passed to Signcode.exe
- Associate CAB's with an Applet.
- Sing an Applet - use JavaKey.exe by
- IE & Netscape resources
- Miscellaneous Links & Notes