Control JNLP jar files download time

Hello,
I have a JNLP application which will run over internet , my problem is that anyone can go to the url and launch the application and download all the jars, before even logging in, i'm worried about using this for Denial of service.
is there a way that i can control the jar files download time, like only download the necessary jar first and when jars are needed will be downloaded eventually
Any Help would be appreciaetd
regards

elie_nasrani wrote: I have a JNLP application which will run over internet , my problem is that anyone can go to the url and launch the application and download all the jars, before even logging in, i'm worried about using this for Denial of service.
is there a way that i can control the jar files download time, like only download the necessary jar first and when jars are needed will be downloaded eventually
Web start offers lazy downloads, as well as the DownloadService* (DS) to help with this kind of problem.
'Lazy' means the resource is only downloaded when needed, but using the DS offers even greater control, even to the extent of manually blocking a download - if needed.
* e.g. of the Download service, be sure to follow the links.
<http://www.physci.org/jws/#ds>
As far as 'signing' goes, I cannot imagine how that would help for your problem. Not only are signed Jar's (at least slightly) larger, but they can also be used by JWS apps. coming from other domains! If your app. is sandboxed, I strongly recommend keeping it as unsigned code.
Why is your JNLP file exposed to the general public? Don't the users have to log in before they can get to the page with link to the application JNLP?
If that is the case, the only chance for users who are not logged in to launch it, is if a friend sends them a direct link to the JNLP file.
As an aside, I generally do not have time to look at posts with no 'dukes' assigned (see links at upper left), if getting a solution is important to you, it is a good idea to add some.

Similar Messages

JNLP jar (re)download

Hello All ,
I might be having a fundamental misconception here ; if so , please help me put it right.
I have a JNLP file which is automatically generated (automatic here actually indicates that a script will populate a particular field in the file (which holds references to some jar files). The rest of the file does not change)).
I am using the <version> attribute of the <jnlp> tag to indicate the version of the application.
My expectation is that each time this version attribute changes , the .jnlp file wlil be re-downloaded and also will be re-downloaded each of the jar files it references.
Below is a representative code sample :
<code>
<?xml version="1.0"; encoding="utf-8"?>
<jnlp
spec="1.0+";
codebase="$$codebase"
href="$$name"
version="%VERSION%">

<information>
. 
</information>
<security><all-permissions/></security>
<resources>
<j2se version="1.6+"; initial-heap-size="32m" max-heap-size="512m" />
<jar href="my.jar";/>
<jar href="my2.jar";/>
<property name="property1" value="value1" />
<extension href="another.jnlp"; /> 
</resources>
<application-desc main-class="my.main";/>
</jnlp>
</code>
The following scenario is what I am trying to implement :
a)Deploy the jnlp application on a server and access it by using http://localhost:XXXX/myapp
b)It downloads and installs and runs.
c)I close the app.
d)I now change one of the jar files referenced in another.jnlp and also some contents in my.jar and my2.jar.
e)I now repeat steps a) and b) (the .jnlp files "version" attributes are updated accordingly)
EXPECTATION : The jnlp file is re-downloaded and so are all the referenced jars[of particular interest my2.jar and any referenced jars in another.jnlp].
OBSERVATION : The jnlp file is re-downloaded but the OLD jars are still being used (I know its the old jars because I change something in the jar on the server and the change is not reflected in the client browser).
If I clear the java cache by doing a "javawas - uninstall" , I get the behaviour I seek in EXPECTATION ; however I do not want to clear the cache everytime I update some jar or other ; I want jnlp to detect that a jar has changed and re-download it.
How do I go about achieving this?

elie_nasrani wrote: I have a JNLP application which will run over internet , my problem is that anyone can go to the url and launch the application and download all the jars, before even logging in, i'm worried about using this for Denial of service.
is there a way that i can control the jar files download time, like only download the necessary jar first and when jars are needed will be downloaded eventually
Web start offers lazy downloads, as well as the DownloadService* (DS) to help with this kind of problem.
'Lazy' means the resource is only downloaded when needed, but using the DS offers even greater control, even to the extent of manually blocking a download - if needed.
* e.g. of the Download service, be sure to follow the links.
<http://www.physci.org/jws/#ds>
As far as 'signing' goes, I cannot imagine how that would help for your problem. Not only are signed Jar's (at least slightly) larger, but they can also be used by JWS apps. coming from other domains! If your app. is sandboxed, I strongly recommend keeping it as unsigned code.
Why is your JNLP file exposed to the general public? Don't the users have to log in before they can get to the page with link to the application JNLP?
If that is the case, the only chance for users who are not logged in to launch it, is if a friend sends them a direct link to the JNLP file.
As an aside, I generally do not have time to look at posts with no 'dukes' assigned (see links at upper left), if getting a solution is important to you, it is a good idea to add some.

Where are the jar files downloaded.

When I run a javafx sample, the first time, it downloads so many jarfiles to a particular place on my box. When I run another sample, it downloads some other jar files, and I can bet some of the jar files downloaded by the previous sample are also downloaded by this sample, I am just thinking, if there is a central place where all downloads go to, then can we have an app check in that folder to see if a jar file is present before downloading it again??
sa

trinisoftinc wrote:
When I run a javafx sample, the first time, it downloads so many jarfiles to a particular place on my box. When I run another sample, it downloads some other jar files, and I can bet some of the jar files downloaded by the previous sample are also downloaded by this sample, I am just thinking, if there is a central place where all downloads go to, then can we have an app check in that folder to see if a jar file is present before downloading it again??
saHey trinisoftinc - I recommend you go investigate java webstart (jnlp). This behavior should not unique to JavaFX applications packed into jnlp but Java as well. I believe it's quite complex and I think Sun have done the right thing here. Duplication is better than potential inconsistencies between supposedly 'identical' jar's. Also, who really sign's jar's anyway.... not many... if any ;)

How to make a jar file downloadable with IE

hello,
I just bought a website:
http://www.frozenfountain.net/
and I put a jar file on it called Logo.jar
Using Mozilla, the jar file downloads as expected, but with Internet Explorer, it tries to download it as .zip file.
How do I get it to download as a .jar file with IE?
thanks

Just post a link to the Jar. Mozilla will download
it as a jar. Windows will download it as a zip.
Only one link. No problem, really. ;-)There is a problem. People who arent as good with computers as you are won't know how to run the jar file after downloading with IE.
At school, I told someone to download the file, which they did with IE. It downloaded to desktop as a zip. They extracted and were left with a bunch of .class files.
On a sidenote, how do you draw text with a gradient?

Jar files downloaded from SkyDrive are being renamed to jar.zip files

I have cut and pasted the following series of exchanges from when I posted the problem onto SkyDrive's support forum. I hope that someone might be able to propose a better solution to the problem that I have. Thanks for your help.
MDSms asked on
Uploaded jar files convert to jar.zip files when downloaded from SkyDrive
I have uploaded an executable jar file to SkyDrive. (I will call this FILE.jar). The file is intact and indicates that it is a jar file type when the file is viewed by Properties within Skydrive. However, when I download (or others download through a share link) the file, it is being saved onto the local computer's download file with .zip appended to the file name (FILE.jar.zip). The downloaded file can be renamed to remove the .zip appendage and subsequently run successfully. However the folder options for the folder where the downloaded file resides must be changed for disable "Hide known file extensions" prior to being able to remove the .zip appendage. While I have figured out the workaround for this problem, this manual renaming procedure is entirely too cumbersome as a solution for sharing this file with others. How can I prevent or disable the FILE.jar file from being renamed to FILE.jar.zip when it is downloaded from SkyDrive?
All Replies (5)
Audrey_P. replied on
Forum Moderator
Hi,
Thank you for posting. Let me try to assist you with your issue with your files.
In order for us to reproduce the issue on our end. Please provide us with the exact steps that you did when you uploaded the files as well as the steps when you are downloading it.
We will be needing the steps to help us figure put what is causing you this issue.
We look forward to your response.
Thank you.
Audrey P.
MDSms replied on
Reply
The file was uploaded by first logging onto my SkyDrive account using Windows 7 Pro and Firefox browser, then a new folder in my account was created without sharing privileges, then the folder was opened and the FILE.jar was uploaded into the folder using the "Upload" option on skydrive account menu. Sharing privileges for FILE.jar were then created (view only), and the shortened url link was sent to the individuals that I was trying to share the file with. was then turned on. When these people use the link to download the file, it is being saved as FILE.jar.zip.
When I try to download the file through the skydrive account download option, it is being saved onto my computer as FILE.jar.zip and this occurs when I try to download the file while signed into my skydrive account as well as when I am not signed into my skydrive account (using the shared file link).
This PNG shows the information provided by clicking on the download icon (down arrow) within the Firefox browser; note that the file was downloaded as FILE.jar.zip and that the source was live.com. When I use Windows Explorer to look at the same file within the Download folder itself, examining the file's properties details also shows that it is being saved as FILE.jar.zip and is of the file type compressed zip folder.
This PNG shows the information displayed to me from my skydrive account when I view the originally uploaded file's properties; note that the information shows that the file is a jar file type.
When I utilize Internet Explorer 9 to access the file, FILE.jar is being downloaded onto my computer as a jar file type. This PNG shows the information provided by Tools/View Downloads within the IE9 browser. Note that in this instance, the information indicates that the file is being downloaded from yzudea.blu.livefilestore.com.
It appears to me that the problem (the FILE.jar file being renamed to FILE.jar.zip) arises from the fact that a jar file downloaded from skydrive using firefox, is being sent from live.com whereas a jar file downloaded from skydrive using IE9 is being sent from yzudea.blu.livefilestore.com.
I want to make sure that a person receiving a share link from me for FILE.jar is able to download it without modification to the file name regardless of which browser is being using to access the link. How can I make sure that this occurs?
Any help is appreciated. Thanks.
Michelle Anne D. replied on
Forum Moderator Community Star Community Star
Reply
Hi MDSms,
I appreciate you for providing as much information as you can about the issue, as well as for uploading screenshots on what you see from the downloaded file. About your initial concern wherein the file gets renamed with .zip after the original file extension, this is solely dependent on the browser that you are using since they have a different safety/security measure that needs to be implemented.
Moreover, you may see the file servers live.com and yzudea.blu.livefilestore.com to be different with one another, but they actually are sent from the same SkyDrive server. This in turn, depends on the web browser where the file is being downloaded as well. The live.com file where it was downloaded from Firefox simply masks its original server yzudea.blu.livefilestore.com.
As for your last query about your recipients downloading the file without the hassle of renaming it from a .zip file, you can simply tell them to download it through Internet Explorer.
Should you have other queries or additional information that might help in our investigation, I highly encourage you to post them here.
Regards,
Michelle
MDSms replied on
Michelle,
Thanks for your reply. Yes, I could simply tell them to download the file through Internet Explorer, but is there another solution or workaround to the problem I have described here? Am I being punished with the curse of this problem simply because I (or the individuals with which I wish to share FILE.jar with) choose to use Firefox instead of IE? Will the use of any other browser instead of IE (Chrome, Safari, etc., etc.) still result in the same problem?
You stated that it is "solely dependent on the browser that you are using since they have a different safety/security measure that needs to be implemented"........could the problem be overcome by designating one or both of the file server addresses as Trusted Sites within the browser options setting?
I look forward to your response. Thanks in advance.
Joy V. replied on
Forum Moderator Community Star Community Star
Reply
Hi MDSms,
We understand your concern. Since the issue does not occur in Internet Explorer, it has something to do with Firefox's security feature. You might want to verify this concern by contacting Firefox support.
Hope this helps. Let us know if we can further assist you with SkyDrive.
Thanks,
Melanie Joy

Try to delete the mimeTypes.rdf file in the Firefox profile folder to reset all file actions.
*http://kb.mozillazine.org/mimeTypes.rdf
*http://kb.mozillazine.org/File_types_and_download_actions#Resetting_download_actions

How can I change the file download time using Adobe Send? Adobe SendNow had a lot more options.

How can I change the file download time using Adobe Send? Adobe SendNow had a lot more options.I don't see nay with Adobe Send.

There isn't a feature in Adobe Send for setting and end-date for a file's availability. At any time, you can Unshare the file, however.

.JAD/JAR file download problems

Hi,
I'm having trouble with downloads of .jad and .jar files through WAP onto my mobile phone. The .JAR file downloads fine via the WAP APN but then the .JAD file doesn't download.
From what I can see, it looks like the j2me app manager on the phone which reads the jad file tries to download the .JAR file directly from the website. The problem here is that since i'm connected to a WAP APN, i have to download through the proxy so there's no direct access to the internet.
Anyone else have this kind of problem?
Is is possible to set up the .JAD file somehow so that it downloads through a proxy or takes the current APN to download it??
This is a HTTPS site but I dont think that would make a difference.
Cheers,

Hello,
I have a very similar problem. Not quite the same tho: i am able to download the JAD and the JAR gets requested. One some phones the JAR gets downloaded properly but on others it blocks after 50 or 60 %.
We only encounter this problem when downloading through a proxy (defined in the phones wap/internet configuration); when we connect without a proxy everythibng works just fine.
Another clue might be the fact that we cannot do HTTPS communication (from the device) using a connection that is proxied. (We tested by putting the file on the device using bluetooth).
Has anybody seen this before? Do you know a solution to this problem?
Thank you,
Nick

Jar Files download Slow in IE but not FireFox

We have an application (PTC Windchill) that uses jar files within the application. These jar files contain our customizations and get downloaded to the users when they require certain functionality within the application. Each time we update our build (update the customizations) new jar files are required to be downloaded to the client. Recently, we have seen an increase in the number of clients that the downloads take an extremely long time. The jar files add up to about 70mb and on a machine that we consider to be working correctly, this takes less than a minute. On some machines, it takes as long as 20 minutes. We are unable to determine what the difference is between computers (both have the same version of JRE, OS, IE and updates etc.). What is interesting, is the files download quickly on FireFox, every time on every machine. We initially thought this was an IE issue, but we can't pin point it. Also, the files transfer fine through the OS so we don't believe it is network or NIC related. This started out as just a few computers but seems to be growing. We have found upgrading to Apache 2.x.x from 1.3.27 fixes the problem, but breaks something else in our application, therefor is not a solution. This would appear to be an IE and Apache compatibility issue, but why it works with some clients and not others, puzzles us. I was hoping someone out there may have some ideas of what the issue is. It is probably something simple, but not simple to find. Any help is much appreaciated.
Thanks,

It's probably an IE problem.
The installed JREs on the client machines have no relationship with downloading via a browser.
It works fine with firefox because this latter is an open source and frequently upgraded. There are lot of firefox plugins and extensions for downloading tasks: https://addons.mozilla.org/en-US/firefox/search?q=download&status=Array
You can allocate more resources for your server and use a multi-thread donwload servlets but it will not resolve the problems of the client side IE browser.

Jar file download

I have an applet served from orion application server. There are several Jar files that need to be downloaded to the client in order for the application to work. I noticed in JRE 1.3.1 when a Jar file was downloading a pop up with status Bar appeared, showing the status of the download. However clients that use 1.4.0 don�t have these status bars. Is there any way to insure the use of these status bars? Does 1.4.1 include them?
Also download of these jar files takes a while ~10 min. Is there a way to increase download time besides the obvious (faster speeds, slimming down the jar file)?

Yes when the jar files are downloading -- there was a status bar to indicate how much of the jar file was downloaded. It was a good indicator that the browser was still doing something.

Automated Jar file download

Hi,
I was planning download and run a jar file in an automated way.
I want to do this using an html. When i open the html it should go and download the jar file and then run the jar. I want to do this using java.
What is the best way to do this. Do i've to use applets for this ?
Are there any existing examples .
Thanks in advance
Jagadeesh

jag_chandra wrote:
Java Web StartJava Web Start is a helper application that gets associated with a Web browser. When a user clicks on a link that points to a special launch file (JNLP file), it causes the browser to launch Java Web Start.Who are you telling? I doubt anyone in this thread is unaware of what JWS is.
Java web Start requires user click , isn't it. Is that a question? If so, please don't forget to add a question mark.
but the actual situation is i've 100's of jar file url's, i need to scroll through each one of them and run them automatically on java installed machine. I can't get the user to click on them. I want to create a html when opening the html in the browser it should do this bit .
Can JavaWebstart do this ? How does the user get to the page with 'hundreds of URLs'? Is it perhaps via a link they need to click on?
If that is the case, replace that link to a href pointing to one (note ONE) JNLP file. In the JNLP launch file, list the 'hundreds of Jars' and mark them as a lazy download. Specify the main-class as a helper class that will go through the lazy download of the 100s of Jars one by one, cache each one then run it.
The problem is solved with as many clicks as it took to get to your original page, and most of the gory details of the hundreds of Jars are hidden from the end user.

Replacing jar files real-time in classpath

Hi All
I have a swing application and It runs perfectly. I have created a update manager that can download jar files for the application. This update manager downloads jar files and replaces the jar files that are currently in the class path. You could say the update is real-time.
After the files are downloaded I get errors like class not found and other really strange Java errors. The class not found errors indicate that the application cant find classes that are in the downloaded jar file.
Is there any way to prevent this from happening?
Thanks in advance,
Martyn Hiemstra

I am currently just saving the downloaded files into the classpath directory, so in short I'm replacing them while the JVM is running.
The problem is that my Java application is installed using install4j meaning that the application is started as a .exe file. The problem is that I would need to create an external application to update the files but the external programme would have not idea where to put the newly downloaded files. T o overcome this all I want to create an updater within my own application.
Is there a way to shutdown real-time loading of jar files in the class path? That would solve the problem since the newly loaded jar files arent detected until the application is started again.

Jar files download problems in Java Webstart with JRE 1.6

We have encountered a few problems in Java Webstart with JRE 1.6
In JRE 1.5, the jar files are getting downloaded onto the client
machine with it's original names.
Example :
Server File Name : acm.jar
Client File Name : RMacm.jar
But in JRE 1.6, the jar files are getting downloaded with improper file names.
Example :
Server File Name : acm.jar
Client File Name : 4fb074cc-66fc7407
Moreover the path itself seems to be invalid.
Example Path :
JRE 1.5 path:
C:\Documents and Settings\Administrator\Application
Data\Sun\Java\Deployment\cache\javaws\https\D17.16.23.11\P443\DMtest\DMwebStart
JRE 1.6 path:
C:\Documents and Settings\Administrator\Application
Data\Sun\Java\Deployment\cache\6.0\12
Due to this, we are facing Classpath problems.
What changes do we have to make to the code, for Java
Webstart to work ?
We are using JBoss 4.0.4 and JDK 1.5 in the Server
On the client machine, we have IE 6 and JRE 1.6.01
Help would be appreciated.

Ask your Java Web Start question at:
http://forum.java.sun.com/forum.jspa?forumID=38

Where are jar files downloaded to with Applet?

I have an Applet and am using archive attribute in my applet tag to specify jar files needed by the applet. eg: "archive=myclassfiles.jar, foo.jar". Assume that myclassesfiles.jar has classes needed by the Applet and Foo.jar has some text files or xml files. Assume that Applet is signed.
My question: I am assuming that all jar files are downloaded to the client when the Applet is started. Is this correct? If so, how can I open and read Foo.jar file within the Applet? I dont know the path to that file, that is, I dont know where on the client that Jar file has been downloaded to. Would the following work:
URL aUrl = (new File("Foo.jar")).toURL();
String path = aUrl.toString();
would path point to the correct location of Foo.jar?

They are downloaded to the client, and stored in a cache. I'm not sure they are readable from within the applet, however. But there are 2 solutions, depending on what you are doing.
1) You want to get some images or other resources from the Jar file. Then do this:
URL url = appletClass.getClass().getResource("myimage.jpg");
ImageIcon icon = new ImageIcon(url);
where appletClass is the applet object, and the resource ("myimage.jpg" is the relative path to the image in the Jar file.
2) You want to muck around with the Jar (read it). Well you can't write to it that easily in an applet, as you can't access the file system without a signed applet, or you would have to POST it back to the web server via HTTP file upload. But if you want to just read it and get stuff out of it, you can always just do this:
URL url = new URL(getDocumentBase(), "foo.jar");
and then open the URLConnection for that URL and read the Jar in.

Jar file downloaded still the old version

If I update a new jar file in the web server, The jar file being downloaded by a remote pc is still the old jar file even if the java plugin cache has been deleted. In my source below, I have already specified applet option as plugin.
Below is the source code for applet caching:
Hope someone could help thanks
<OBJECT
classid="clsid:8AD9C840-044E-11D1-B3E9-00805F499D93"
width="0" height="0" align="baseline" codebase="http://java.sun.com/products/plugin/1.3/jinstall-13-win32.cab#Version=1,3,0,0">
<PARAM NAME=<%=IboReserved.SCREEN_BUILDER%> VALUE="com.weserv.ibo.gui.InternetBanking">
<PARAM NAME="trxcode" VALUE="0">
<PARAM NAME="langind" VALUE="en">
<PARAM NAME="country" VALUE="US">
<PARAM NAME="code" VALUE="McpgApplet.class">
<PARAM NAME="codebase" VALUE="http://mcpgdev.bancnet.net/apps">
<PARAM NAME="type" VALUE="application/x-java-applet;version=1.3">
<PARAM NAME="cache_archive" VALUE="<%= appletArchive %>">
<PARAM NAME="cache_version" VALUE="<%= appletVersion %>">
<PARAM NAME="cache_option" VALUE="Plugin">
<COMMENT>
<EMBED type="application/x-java-applet;version=1.3"
width="0" height="0" align="baseline"
code="McpgApplet" name="mcpgApplet" codebase="http://mcpgdev.bancnet.net/apps"
pluginspage="http://java.sun.com/products/plugin/1.3/plugin-install.html">
<NOEMBED>
</COMMENT> No Java 2 support for APPLET!! </NOEMBED>
</EMBED>
</OBJECT>

download the zip file unzip it under windows install the drivers you need upgrading
thats what I did and it updated my video card driver so windows stopped crashing

Jar file downloaded using FTP gets damaged

Hi people, Am working on a solution that implements an auto update of an application developed using Java. I am using Apache commons package for downloading the updated JAR file from an FTP site. Once I have the new JAR file on my local machine, I double click it and I get the following error. Invalid or corrupt jarfile C:\FIDS\FIDS.jar When I use a different FTP client to download my JAR file, the file works well when double clicked. What could be happening on my JAR file. Thanks and regards.

tdulce_aboo wrote:
I know that FTP is not the best solution, however, sometimes we are bound by what the client has in place.I know, it wasn't trying to attack you, it was just a general rant. FTP is so common and when it's the only thing available you obviously have to use it. I just don't understand those who actively enable it on their server and suggest (or even require) its use.
What is your suggestion,that I use http? or ?That depends on what it's used for.
My normal one-stop replacement would be SFTP: based on SSH, secure, authenticated, tunnelable, uses a single connection, doesn't do stupid "translations" of the transfered data, ...

Control JNLP jar files download time

Similar Messages

Maybe you are looking for