Covers browser security issues.

Browser Security
     Netscape
     Internet Explorer
     Links / Downloads

 

Background Info

When running applets in a browser, these applets are limited as to what they can do on the client and server machines.  These applets run in what is known as the "sandbox".  An applet cannot run specific commands unless given permission to do so.  For example, one of the things an applet is not allowed to do is read or write files locally or on the server.  It must obtain special permission (s) by the browser to be able to step out of that sandbox.  In addition, the developer may decide to digitally "sign" the application.  Signing provides the user with a more sense of security since a 3rd company "vouches" for the developer by guarantying that the individual/company are who they say they are.  For more information regarding Signing, click here.

Unfortunately in today's browser "wars" (mainly between Microsoft's Internet Explorer and Netscape's Communicator) each vendor decided to handle security differently.   This translates into different ways of handling security permissions within your Java and HTML code and several unnecessary headaches.  For example, Internet Explorer requires the developer to "sign" the application, while Netscape does not.   We will try to cover how both of these browsers handle permissions, including what tools you as a developer need to download and implement in order to make this a more pleasant experience.

Internet Explorer

With Internet Explorer, in addition to using the code signing tools included with Microsoft's Java SDK 3.1, you will also need to use the "com.ms.Security" package in your Java code to provide the proper access.  For more information go to the Code Signing with Internet Explorer document.  The following documentation will explain what is needed and the steps on how the code signing should be done.  First of all, you need to download the following:

Microsoft SDK for Java v3.1

This package contains everything we need to create the archive file and the code we need to add to the java application.

After the file is downloaded and installed, we are ready to proceed.

  1. The first thing we need to do is update the Microsoft "Classes.zip" file included in Windows.  To do this, you must run the following command:

    clspack - auto

    This executable is located in the "sdk-install\bin" sub-directory (where sdk-install is where you installed SDK 3.1).  This   will create the new Classes.zip and place it in the "Windows/java" sub-directory (also, make sure that this directory is       added to the CLASSPATH (we will use the com.ms.Security package that is in the Classes.zip file).

  2. Create your own certificate ( in this example, we are not digitally signing it).

    makecert -sk KeyName -n "CN=Your Name" MyCert.cer

    This creates the certificate file called Mycert.cer.  The key name "KeyName" is stored in the registry (when you create a   digitally signed archive, the key is available as a file).  Under "Your Name" you can enter your name or company name.

  3. You then need to create the SPC file (used to sign the archive):  cert2spc MyCert.cer MyCert.spc
  4. Next, you can copy and past into a new file a cab batch file. this file was created and is located in the sys/os/dos directory.
  5. Once the tthree files are created (cer, spc, and bat), you are ready to create the cab archive and sign it.  You first need to create a top-level directory where the signing is going to take place. In our case, we created a sub-directory of "nxm" called "ie".  We then copied all the class files (including the sub-directories) from the packages (sys.lib, nxm.sys.libg, sys.inc, and sys.prim) to nxm/ie/sys.
  6. Open up a Command Prompt window, and go to the nxm directory.  From here, run the following command:

    cabsign ie NeXtMidas

    "ie" is the name of the sub-directory that contains all the class files.   "NeXtMidas" is the name of the application that will    be using the signed archive.

  7. This creates a file called "ie.cab" in the nxm directory.  The final step is to add the following code to the HTML file that runs the applet:

    <applet code="sys.lib.BrowserIF.class" width="100%" height="100%">
      <param name="Name" value="BrowserIF">
      <param name="CABBASE" value="ie.cab">
    </applet>

    Noticed that we added the parameter name "CABBASE" and set it equal to our CAB file ie.cab....

  8. for the final step, we must add the code to our Java class file that will allow us to read and write files (make sure that you import the com.ms.Security.* package in the file where you will be adding the following code:

        try {
        if (Class.forName("com.ms.security.PolicyEngine") != null)
          PolicyEngine.assertPermission(PermissionID.FILEIO);
      } catch (Throwable cnfe) {
        System.out.println("No privilege to access local environment\n");
      }

        The PermissionID.FILEIO permission will allow us to read and write files when running our applet in Internet Explorer.  for           other commands, please go to the PermissionID class in the Microsoft web site.

When you run the HTML file, you will get a prompt window like the following:

images/GrantIE.gif (37842 bytes)

 

If you need any additional information, the following links may help.

 

 

Links and Downloads

Code Signing for Java Applets
Netscape Capabilities API
IE Security Articles and References
IE - Download SDK for Java 3.1
Java Security Hotlist

Author:
Lalo Gamez