Covers browser security issues.
Browser Security |
Netscape |
Internet Explorer |
Links / Downloads |
When running applets in a browser, these applets are limited as to what they can do on the client and server machines. These applets run in what is known as the "sandbox". An applet cannot run specific commands unless given permission to do so. For example, one of the things an applet is not allowed to do is read or write files locally or on the server. It must obtain special permission (s) by the browser to be able to step out of that sandbox. In addition, the developer may decide to digitally "sign" the application. Signing provides the user with a more sense of security since a 3rd company "vouches" for the developer by guarantying that the individual/company are who they say they are. For more information regarding Signing, click here.
Unfortunately in today's browser "wars" (mainly between Microsoft's Internet Explorer and Netscape's Communicator) each vendor decided to handle security differently. This translates into different ways of handling security permissions within your Java and HTML code and several unnecessary headaches. For example, Internet Explorer requires the developer to "sign" the application, while Netscape does not. We will try to cover how both of these browsers handle permissions, including what tools you as a developer need to download and implement in order to make this a more pleasant experience.
With Internet Explorer, in addition to using the code signing tools included with Microsoft's Java SDK 3.1, you will also need to use the "com.ms.Security" package in your Java code to provide the proper access. For more information go to the Code Signing with Internet Explorer document. The following documentation will explain what is needed and the steps on how the code signing should be done. First of all, you need to download the following:
This package contains everything we need to create the archive file and the code we need to add to the java application.
After the file is downloaded and installed, we are ready to proceed.
clspack - auto
This executable is located in the "sdk-install\bin" sub-directory (where sdk-install is where you installed SDK 3.1). This will create the new Classes.zip and place it in the "Windows/java" sub-directory (also, make sure that this directory is added to the CLASSPATH (we will use the com.ms.Security package that is in the Classes.zip file).
makecert -sk KeyName -n "CN=Your Name" MyCert.cer
This creates the certificate file called Mycert.cer. The key name "KeyName" is stored in the registry (when you create a digitally signed archive, the key is available as a file). Under "Your Name" you can enter your name or company name.
cabsign ie NeXtMidas
"ie" is the name of the sub-directory that contains all the class files. "NeXtMidas" is the name of the application that will be using the signed archive.
<applet
code="sys.lib.BrowserIF.class" width="100%"
height="100%">
<param name="Name" value="BrowserIF">
<param name="CABBASE" value="ie.cab">
</applet>
Noticed that we added the parameter name "CABBASE" and set it equal to our CAB file ie.cab....
try {
if
(Class.forName("com.ms.security.PolicyEngine") != null)
PolicyEngine.assertPermission(PermissionID.FILEIO);
} catch (Throwable cnfe) {
System.out.println("No privilege to access
local environment\n");
}
The PermissionID.FILEIO permission will allow us to read and write files when running our applet in Internet Explorer. for other commands, please go to the PermissionID class in the Microsoft web site.
When you run the HTML file, you will get a prompt window like the following:
If you need any additional information, the following links may help.
Links and Downloads |
Code Signing for Java Applets |
Netscape Capabilities API |
IE Security Articles and References |
IE - Download SDK for Java 3.1 |
Java Security Hotlist |