JNLP jar (re)download

Question

Hello All ,
I might be having a fundamental misconception here ; if so , please help me put it right.
I have a JNLP file which is automatically generated (automatic here actually indicates that a script will populate a particular field in the file (which holds references to some jar files). The rest of the file does not change)).
I am using the <version> attribute of the <jnlp> tag to indicate the version of the application.
My expectation is that each time this version attribute changes , the .jnlp file wlil be re-downloaded and also will be re-downloaded each of the jar files it references.
Below is a representative code sample :
<code>
<?xml version="1.0"; encoding="utf-8"?>
<jnlp
spec="1.0+";
codebase="$$codebase"
href="$$name"
version="%VERSION%">
<!-- version to be filled in by a script-->
<information>
. <!-- Some information here -->
</information>
<security><all-permissions/></security>
<resources>
<j2se version="1.6+"; initial-heap-size="32m" max-heap-size="512m" />
<jar href="my.jar";/>
<jar href="my2.jar";/>
<property name="property1" value="value1" />
<extension href="another.jnlp"; /> <!-- another .jnlp contains a list of jars that is generated by another script -->
</resources>
<application-desc main-class="my.main";/>
</jnlp>
</code>
The following scenario is what I am trying to implement :
a)Deploy the jnlp application on a server and access it by using http://localhost:XXXX/myapp
b)It downloads and installs and runs.
c)I close the app.
d)I now change one of the jar files referenced in another.jnlp and also some contents in my.jar and my2.jar.
e)I now repeat steps a) and b) (the .jnlp files "version" attributes are updated accordingly)
EXPECTATION : The jnlp file is re-downloaded and so are all the referenced jars[of particular interest my2.jar and any referenced jars in another.jnlp].
OBSERVATION : The jnlp file is re-downloaded but the OLD jars are still being used (I know its the old jars because I change something in the jar on the server and the change is not reflected in the client browser).
If I clear the java cache by doing a "javawas - uninstall" , I get the behaviour I seek in EXPECTATION ; however I do not want to clear the cache everytime I update some jar or other ; I want jnlp to detect that a jar has changed and re-download it.
How do I go about achieving this?

Answer 1

elie_nasrani wrote: I have a JNLP application which will run over internet , my problem is that anyone can go to the url and launch the application and download all the jars, before even logging in, i'm worried about using this for Denial of service.
is there a way that i can control the jar files download time, like only download the necessary jar first and when jars are needed will be downloaded eventually
Web start offers lazy downloads, as well as the DownloadService* (DS) to help with this kind of problem.
'Lazy' means the resource is only downloaded when needed, but using the DS offers even greater control, even to the extent of manually blocking a download - if needed.
* e.g. of the Download service, be sure to follow the links.
<http://www.physci.org/jws/#ds>
As far as 'signing' goes, I cannot imagine how that would help for your problem. Not only are signed Jar's (at least slightly) larger, but they can also be used by JWS apps. coming from other domains! If your app. is sandboxed, I strongly recommend keeping it as unsigned code.
Why is your JNLP file exposed to the general public? Don't the users have to log in before they can get to the page with link to the application JNLP?
If that is the case, the only chance for users who are not logged in to launch it, is if a friend sends them a direct link to the JNLP file.
As an aside, I generally do not have time to look at posts with no 'dukes' assigned (see links at upper left), if getting a solution is important to you, it is a good idea to add some.