Covers browser security issues.

Background Info

Unfortunately in today's browser "wars" (mainly between Microsoft's Internet Explorer and Netscape's Communicator) each vendor decided to handle security differently.   This translates into different ways of handling security permissions within your Java and HTML code and several unnecessary headaches.  For example, Internet Explorer requires the developer to "sign" the application, while Netscape does not.   We will try to cover how both of these browsers handle permissions, including what tools you as a developer need to download and implement in order to make this a more pleasant experience.

Internet Explorer

With Internet Explorer, in addition to using the code signing tools included with Microsoft's Java SDK 3.1, you will also need to use the "com.ms.Security" package in your Java code to provide the proper access.  For more information go to the Code Signing with Internet Explorer document.  The following documentation will explain what is needed and the steps on how the code signing should be done.  First of all, you need to download the following:

Microsoft SDK for Java v3.1

This package contains everything we need to create the archive file and the code we need to add to the java application.

After the file is downloaded and installed, we are ready to proceed.

1. The first thing we need to do is update the Microsoft "Classes.zip" file included in Windows.  To do this, you must run the following command:

   clspack - auto

   This executable is located in the "sdk-install\bin" sub-directory (where sdk-install is where you installed SDK 3.1).  This   will create the new Classes.zip and place it in the "Windows/java" sub-directory (also, make sure that this directory is       added to the CLASSPATH (we will use the com.ms.Security package that is in the Classes.zip file).

2. Create your own certificate ( in this example, we are not digitally signing it).

   makecert -sk KeyName -n "CN=Your Name" MyCert.cer

   This creates the certificate file called Mycert.cer.  The key name "KeyName" is stored in the registry (when you create a   digitally signed archive, the key is available as a file).  Under "Your Name" you can enter your name or company name.

3. You then need to create the SPC file (used to sign the archive):  cert2spc MyCert.cer MyCert.spc
4. Next, you can copy and past into a new file a cab batch file. this file was created and is located in the sys/os/dos directory.
5. Once the tthree files are created (cer, spc, and bat), you are ready to create the cab archive and sign it.  You first need to create a top-level directory where the signing is going to take place. In our case, we created a sub-directory of "nxm" called "ie".  We then copied all the class files (including the sub-directories) from the packages (sys.lib, nxm.sys.libg, sys.inc, and sys.prim) to nxm/ie/sys.
6. Open up a Command Prompt window, and go to the nxm directory.  From here, run the following command:

   cabsign ie NeXtMidas

   "ie" is the name of the sub-directory that contains all the class files.   "NeXtMidas" is the name of the application that will    be using the signed archive.

7. This creates a file called "ie.cab" in the nxm directory. 
8. for the final step, we must add the code to our Java class file that will allow us to read and write files (make sure that you import the com.ms.Security.* package in the file where you will be adding the following code:

        try {
        if (Class.forName("com.ms.security.PolicyEngine") != null)
          PolicyEngine.assertPermission(PermissionID.FILEIO);
      } catch (Throwable cnfe) {
        System.out.println("No privilege to access local environment\n");
      }

When you run the HTML file, you will get a prompt window like the following:

If you need any additional information, the following links may help.

Author:

Lalo Gamez