Untrusted Applet Connection Restrictions

Hi,
There is a security rule that untrusted applets and WebStart applications may connect only to hosts from they was downloaded. But I could not find any strict definition of this rule. What does it mean "downloaded"? Different parts of an applet may be downloaded from various hosts: jnlp from one host, library jars from another and own jars from third. What of these hosts figure as a relay host for applets? Possible variants:
1. Host from .jnlp file was downloaded (or html page containing applet)
2. Host specified in codebase parameter
3. Host from a .jar file that contains main class (or Applet class) was downloaded
Another question is if there is any possibility to connect my applet/webstart app. to various hosts with the same domain? Applet must retrieve information from various hosts but it can be loaded only from one of them. Applet is public and modifying policy file is not a solution. And also I don't want to sign it (it must stay untrusted). Any trick? The only idea I have is write a JavaScript proxy on the page containing applet and use it to make requests...
Antón

By default an applet can communicate with the server from which it originated (that server that was visited by the web browser that served the page containing the applet.) At work we have an internal Linux box running Apache/Tomcat as an intranet server but also MySQL database. Because the applets containing web page and the database are on the same server the default security is fine.
However, if you want your applet to connect to a different server you need to get the usrs permission. If this action was allowed by default then you might get the applet from a trusted site but the applet could then contact an untrusted site. This would be bad.
A way round this is to sign the applet. The user is then prompted to accept that they trust the applet when it loads. If they do then the applet, as I understand it, is free to run as a trusted application would. This would allow it to contact other servers. (I've not tested this. I have only signed applets when I want the to be able to access the clipboard, another protected action.) You would need to do this if you database server and web/intranet server are not the same machine. (There may be other ways around this, but I'm not aware of them.)
The thread below might also be helpful.
http://forum.java.sun.com/thread.jsp?forum=421&thread=530200
regards
sjl

Similar Messages

"Untrusted Initial Connection Warnings"

Hi,
if i connect to SSGD the first time, i got a "Untrusted Initial Connection Warnings"
warning: "The SSGD client connecting to the server ... for the first time. Do you
with to connect to this server ?"
As i found in the docu http://docs.sun.com/source/820-4907/chapter1.html#BBJCEGAG
this behaviour is normal and you can avoid this with a preconfigured hostsvisited file.
Is there a possibility to change the title of the popup ?
Or remove this message without touching the client filesystem ?
If the user reads "Untrusted Initial Connection Warnings", he though
something is broken .... Also, he must accept 2 certificates (java-applet & this initial connection warnung)
to work with SSGD - one would be enough.
regards
Danny

This behaviour is by design - educating users so they are aware that once accepted they should not see these errors again is important to protect their login credentials from man-in-the-middle attacks.
It's unfortunate that SGD uses the JVM and a native helper application, both requiring confirmation but at lease it's only once.

Applet connected to oracle

hi everybody,
i've faced with a small problem while dealing with my homework.
i have a simple applet connected to oracle. if i open it with applet viewer it works correctly but when i put the applet in a html file
i'm getting following error:
java.security.AccessControlException: access denied (java.util.PropertyPermission oracle.jserver.version read)
at java.security.AccessControlContext.checkPermission(Unknown Source)
at java.security.AccessController.checkPermission(Unknown Source)
at java.lang.SecurityManager.checkPermission(Unknown Source)
at java.lang.SecurityManager.checkPropertyAccess(Unknown Source)
at java.lang.System.getProperty(Unknown Source)
at oracle.jdbc.driver.OracleDriver.getConnectionInstance(Oracle Driver.java)
at oracle.jdbc.driver.OracleDriver.connect(OracleDriver.java)
at java.sql.DriverManager.getConnection(Unknown Source)
at java.sql.DriverManager.getConnection(Unknown Source)
at deneme.Connect(deneme.java:163)
at deneme.<init>(deneme.java:41)
at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Nativ e Method)
at sun.reflect.NativeConstructorAccessorImpl.newInstance(Unknow n Source)
at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(Un known Source)
at java.lang.reflect.Constructor.newInstance(Unknown Source)
at java.lang.Class.newInstance0(Unknown Source)
at java.lang.Class.newInstance(Unknown Source)
at sun.applet.AppletPanel.createApplet(Unknown Source)
at sun.plugin.AppletViewer.createApplet(Unknown Source)
at sun.applet.AppletPanel.runLoader(Unknown Source)
at sun.applet.AppletPanel.run(Unknown Source)
at java.lang.Thread.run(Unknown Source)
java.security.AccessControlException: access denied (java.util.PropertyPermission oracle.jserver.version read)
at java.security.AccessControlContext.checkPermission(Unknown Source)
at java.security.AccessController.checkPermission(Unknown Source)
at java.lang.SecurityManager.checkPermission(Unknown Source)
at java.lang.SecurityManager.checkPropertyAccess(Unknown Source)
at java.lang.System.getProperty(Unknown Source)
at oracle.jdbc.driver.OracleDriver.getConnectionInstance(Oracle Driver.java)
at oracle.jdbc.driver.OracleDriver.connect(OracleDriver.java)
at java.sql.DriverManager.getConnection(Unknown Source)
at java.sql.DriverManager.getConnection(Unknown Source)
at deneme.Connect(deneme.java:163)
at deneme.<init>(deneme.java:41)
at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Nativ e Method)
at sun.reflect.NativeConstructorAccessorImpl.newInstance(Unknow n Source)
at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(Un known Source)
at java.lang.reflect.Constructor.newInstance(Unknown Source)
at java.lang.Class.newInstance0(Unknown Source)
at java.lang.Class.newInstance(Unknown Source)
at sun.applet.AppletPanel.createApplet(Unknown Source)
at sun.plugin.AppletViewer.createApplet(Unknown Source)
at sun.applet.AppletPanel.runLoader(Unknown Source)
at sun.applet.AppletPanel.run(Unknown Source)
at java.lang.Thread.run(Unknown Source)
what's the problem? thanks in advance

The simple answer is the applet security sandbox enforced by the browser. You should look on the Sun Java website for details on how to work with applets security.
http://java.sun.com/
Search on keywords applet security
In a nutshell an applet can't open a socket to a server from other than that which it was served. There are (many) other security restrictions that you probably want to read about.
The applet viewer doesn't enforce the sandbox security which it why it works well for you there.

Applet connecting to MS SQL Database (Remote DataSourse)

Hello,
I started by building my interface to a Database within an Application. I am not to the point where I am ready to make it an applet but want to get some tips when the time comes very soon.
First of all what security issues do I have to deal with to let the applet connect to the database?
Second I currently created a local Datasource via ODBC call JavaDB and linked it to my MS SQL Database.
QUESTION
How do I link to the with a remote Datasource so that the local machine does not have to worry about the datasource.
Lastly can I use the "sun.jdbc.odbc.JdbcOdbcDriver" in an applet. I sure hope so...
Then the part of my code that connected to the database was this:
private void initDB(){
String url = "jdbc:ODBC:JavaDB";
Connection con;
String query = "select * from COFFEES";
Statement stmt;
try {
//Class.forName("myDriver.ClassName");
Class.forName("sun.jdbc.odbc.JdbcOdbcDriver");
} catch(java.lang.ClassNotFoundException e) {
System.err.print("ClassNotFoundException: ");
System.err.println(e.getMessage());
try {
con = DriverManager.getConnection(url, DBADM, DBPWD);
stmt = con.createStatement();
ResultSet rs = stmt.executeQuery(query);
ResultSetMetaData rsmd = rs.getMetaData();
System.out.println("");
int numberOfColumns = rsmd.getColumnCount();
for (int i = 1; i <= numberOfColumns; i++) {
 if (i > 1) System.out.print(", ");
 String columnName = rsmd.getColumnName(i);
 System.out.print(columnName);
System.out.println("");
while (rs.next()) {
 for (int i = 1; i <= numberOfColumns; i++) {
 if (i > 1) System.out.print(", ");
 String columnValue = rs.getString(i);
 System.out.print(columnValue);
 System.out.println("");
stmt.close();
con.close();
} catch(SQLException ex) {
System.err.print("SQLException: ");
System.err.println(ex.getMessage());
Thanks,
Kenny

Kenny,
As no one has replied, I've managed to implement a database that uses applets.
Firstly, one needs to obtain a JSP server (apache tomcat is free and can be configured into a IIS 4 server).
Secondly, write all the DB connection stuff within a jsp page (ex.) "builders.jsp"
<%@ page import="java.sql.*" %>
<%!
protected String driver="sun.jdbc.odbc.JdbcOdbcDriver";
protected String url="jdbc:odbc:PhotoDBase";
protected String userid=null;
protected String passwd=null;
%>
<html><head><title>Builder Example</title></head><body>
<%!
public static String GET_BUILDER_QUERY =
"SELECT * FROM BuilderInfo WHERE BuilderID =?";
%>
<%
String bID = "24"; //normally this would use
//request.Parameter("bID");
//in order to pull up a specific
//record. In this test case it is
//hard coded to pull only builder #24
%>
<%
Class.forName(driver);
Connection conn = DriverManager.getConnection(url, userid, passwd);
PreparedStatement stmt = conn.prepareStatement(GET_BUILDER_QUERY);
stmt.setString(1, bID);
ResultSet rs = stmt.executeQuery();
rs.next();
 String buildID = rs.getString("BuilderID");
 String bName = rs.getString("BuilderName");
 String bAddress = rs.getString("Address");
 String bCity = rs.getString("City");
 String bState = rs.getString("State");
 String bZip = rs.getString("Zip");
 String bCName = rs.getString("ContactName");
 String bCLast = rs.getString("ContactLast");
 String bPhone = rs.getString("Phone");
 String bFax = rs.getString("Fax");
 String bMobile = rs.getString("Pager/Cell");
rs.close();
stmt.close();
if (bName == null)
 bName = "No Builder";
if (bAddress == null)
 bAddress = "N/A";
if (bCity == null)
 bCity = "N/A";
if (bState == null)
 bState = "N/A";
if (bZip == null)
 bZip = "N/A";
if (bCName == null)
bCName = "N/A";
if (bCLast == null)
 bCLast = "N/A";
if (bPhone == null)
 bPhone = "N/A";
if (bFax == null)
bFax = "N/A";
if (bMobile == null)
bMobile = "N/A";
%>
Builder: <%= bName%> BuilderID #: <%= buildID%>
 Contact: <%= bCName%> <%= bCLast%>
 Address: <%= bAddress%>
 <%= bCity%>, <%= bState%> <%= bZip%>
 Phone: <%= bPhone%>
 Fax: <%= bFax%>
 Mobile: <%= bMobile%>
<applet code="Build.class" width="600" height="300">
<param name=buildID value=<%= buildID%>>
<param name=bName value="<%= bName%>">
<param name=bAddress value="<%= bAddress%>">
<param name=bCity value="<%= bCity%>">
<param name=bState value="<%= bState%>">
<param name=bZip value="<%= bZip%>">
<param name=bCName value="<%= bCName%>">
<param name=bCLast value="<%= bCLast%>">
<param name=bPhone value="<%= bPhone%>">
<param name=bFax value="<%= bFax%>">
<param name=bMobile value="<%= bMobile%>">
</applet>
</body>
</html>
The jsp gets the data from the DB based on the parameter bID which would be passed to it via a search or input page with various error checking included.
The applet then recieves its data via parameters. (Build.class has been shortened here to show you the meat and potatoes of the whole deal)
//<applet code="Build.class" width="600" height="300"></applet>
import java.awt.*;
import java.awt.Event;
import java.applet.Applet;
import java.io.*;
public class Build extends java.applet.Applet {
protected Panel search ;
protected TextField Nametxt ;
protected TextField Loctxt ;
protected TextField Citytxt ;
protected TextField Statetxt ;
protected TextField Ziptxt ;
protected TextField CNametxt ;
protected TextField CLasttxt ;
protected TextField Phonetxt ;
protected TextField Faxtxt ;
protected TextField Celltxt ;
public Build(){
super();
search = new Panel();
Nametxt = new TextField();
Loctxt = new TextField();
Citytxt = new TextField();
Statetxt = new TextField();
Ziptxt = new TextField();
CNametxt = new TextField();
CLasttxt = new TextField();
Phonetxt = new TextField();
Faxtxt = new TextField();
Celltxt = new TextField();}
public void init(){
 BorderLayout bl = new BorderLayout();
 setLayout(bl);
 add(search, "Center");
 setBackground(Color.white);
 String buildID = getParameter("buildID");
 String bName = getParameter("bName");
 String bAddress = getParameter("bAddress");
 String bCity = getParameter("bCity");
 String bState = getParameter("bState");
 String bZip = getParameter("bZip");
 String bCName = getParameter("bCName");
 String bCLast = getParameter("bCLast");
 String bPhone = getParameter("bPhone");
 String bFax = getParameter("bFax");
 String bMobile = getParameter("bMobile");
Nametxt.setText(bName);
Loctxt.setText(bAddress);
Citytxt.setText(bCity);
Statetxt.setText(bState);
Ziptxt.setText(bZip);
CNametxt.setText(bCName);
CLasttxt.setText(bCLast);
Phonetxt.setText(bPhone);
Faxtxt.setText(bFax);
Celltxt.setText(bMobile);
Hope this will aid you in yours and anyone elses endevours.
James <[email protected]>

Inputstream.java.io.IOException , applet connection

I'm working on a problem with the failure of a java
applet connection to a java servlet.
The connection is via the internet, and over port 80.
the java console loggin reports the following
There was an attempt to redirect a url request,
but the attempt was not allowed by the client. IOException caught in run
could some one let me know what the URL re-direction is here,
much apreciated,
slainte

I have often found this problem with inexperts java programmers.
I could tell you better luck next time, but today I feel generous, so I will answer.
There is a redirect domain problem. When you try to connect the site you receive an ICMP error message, which is the responsable of the error message you can see. That occurs because the URL connects to another URL different (surely because its original URL has changed to another) and you only have to discover the new URL, and try to connect to it.

Generic Connectivity Restrictions

We are planning to connect a Oracle 10g DB to a Sybase 12.5 (both in Solaris) in our development project, and I do not have any previous distributed DB environment connectivity experience.
From the Oracle DB Heterogeneous Connectivity Admin Guide 10g R2, Section 7.1.5 Generic Connectivity Restriction, it mentions that Generic Connectivity does not support stored procedures. Can you clarify that a SQL query to a remote Sybase table does not work if it is written in a Oracle stored procedure?

Yeah, we run generic connectivity on three of our servers. The gateway product was a little faster, but not worth the money difference.
Setup and configuration is easy once you've done it a few times. Remember to put quotes around the usernames/passwords when creating your db links:
create database link <link> connect to "<user>" identified by "<password>" using '<SID>';
Just as an FYI it doesn't work on Linux x86_64. We had to figure that out the hard way.

Do Airport Extreem and Time Capsule support connect restrictions?

I've looked over the manuals for Airport Extreem and Time Capsule and can't see if (or how) these devices support connect restrictions such as:
1) Prevent certain devices from connecting (i.e. via MAC address)
2) Allow/Prevent access at specific times of the day.
Do these devices provide these types of services?
Thanks
-Mike

1) Prevent certain devices from connecting (i.e. via MAC address)
Yes, but only for wireless devices.
2) Allow/Prevent access at specific times of the day.
Yes, but only for wireless devices. You can set up rules for each day of the week if you want. The example below shows Weekdays and Weekends

Can a applet connect to another applet?

can a applet connect to another applet by using socket only? i mean without using serlvet...
what's that--> "exception: com.ms.security: SecurityExceptionEx" ??
kill me please.. >_<

i mean in different machine.. like i have an applet in machine A trying to get a connection with an applet in machine B...

Unity Connection Restriction Table Recommendations / Template

Does anyone have example Unity Connection Restriction Tables they can share?
TIA

It depends on what you need/want to allow and also the local dial plan. For example, an outdial restriction might look like this:
9011* - Blocked
9?????????? - Allow
91?????????? - Allow
* - Blocked
This would block International but allow local 10-digit and LD entries that require 9 as an offnet prefix. All other entries would be blocked.
Hailey
Please rate helpful posts!

What does "untrusted" network connection mean?

If your airport comes on with full service but has an "untrusted" network connection what does that mean?

I believe the "untrusted" network your are referring to means that this type of network is open or unsecured. In essence, anything you send/receive over an untrusted network could be see by anyone.
For WiFi, we use encryption to "trust" or secure a wireless network connection. The most common encryption used today are WEP, WPA & WPA2. (ref: http://docs.info.apple.com/article.html?artnum=107921)

HELP! Applet connecting too Database

I am trying to connect an Applet too a Database file, that will be hosted in the same directory as the html, and jar files. The database connection and manipulation methods are in a seperate class, from the Applet.
I get an error on the line:
Class.forName("sun.jdbc.odbc.JdbcOdbcDriver");
It is beign caught in a try/catch, and I print out what is below, includes exception dump.
Failed to load JDBC/ODBC driver.
java.security.AccessControlException: access denied (java.lang.RuntimePermission accessClassInPackage.sun.jdbc.odbc)
Any help on why this is happening, and how I can fix it, would be appreciated.

signing the applet, would remove almost all restrictions on the applet. But would it remove this restriction, since that particular error, is because the applet is trying to access a class that it is not allowed too.
the client server model, would work also, but you have to leave the server side piece always running, even though it wont always be needed.
a applet servlet setup, I believe could work, but serving servlets is not a capability the server currently has, and the admin, does not particularly want too add it.
I asked for a specific database.
I am in a large company, so maybe I can find what is suggested.
Anymore ideas?
I always appreciate input.

Applet connection

Hi,
I'm using the java plugin. The problem is the following. My applet can't establish a connection with a host different from the host where it comes. Any ideas?
Thanks

The reason are the security restrictions:
http://java.sun.com/docs/books/tutorial/applet/practical/security.html

How to read from untrusted https connection?

i try to read the content of a https URL but when calling httpsurl.getContent() or con.getInputStream() i get the following exception:
javax.net.ssl.SSLException: untrusted server cert chain
 at com.sun.net.ssl.internal.ssl.SSLSocketImpl.a(DashoA6275)
 at com.sun.net.ssl.internal.ssl.ClientHandshaker.a(DashoA6275)
 at com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(DashoA6275)
 at com.sun.net.ssl.internal.ssl.Handshaker.process_record(DashoA6275)
 at com.sun.net.ssl.internal.ssl.SSLSocketImpl.a(DashoA6275)
 at com.sun.net.ssl.internal.ssl.SSLSocketImpl.a(DashoA6275)
 at com.sun.net.ssl.internal.ssl.AppOutputStream.write(DashoA6275)
 at java.io.OutputStream.write(OutputStream.java:56)
 at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(DashoA6275)
 at com.sun.net.ssl.internal.www.protocol.https.HttpsClient.doConnect(DashoA6275)
 at com.sun.net.ssl.internal.www.protocol.https.NetworkClient.openServer(DashoA6275)
 at com.sun.net.ssl.internal.www.protocol.https.HttpClient.l(DashoA6275)
 at com.sun.net.ssl.internal.www.protocol.https.HttpClient.<init>(DashoA6275)
 at com.sun.net.ssl.internal.www.protocol.https.HttpsClient.<init>(DashoA6275)
 at com.sun.net.ssl.internal.www.protocol.https.HttpsClient.a(DashoA6275)
 at com.sun.net.ssl.internal.www.protocol.https.HttpsClient.a(DashoA6275)
 at com.sun.net.ssl.internal.www.protocol.https.HttpsURLConnection.connect(DashoA6275)
 at com.sun.net.ssl.internal.www.protocol.https.HttpsURLConnection.getInputStream(DashoA6275)
the same https url works in internet explorer although a little dialog appears that informs about the untrusted certificate, but i can click O.K. and get the content. How can i tell my java application that it should read the content of such an untrusted server?

I am recyling this for OTT purposes..
Continuing on 360-degree feedback, here is a managerial take on it:
Q: What is a 360-degree feedback?
Manager: You give me open and honest opinions about my performance. Then I take it all on board and do absolutely nothing. If it but worketh, thou may even be introduced to a concept called wages.

Mysql-jdbc applet connection issue

I am developing a user interface for a mysql database. I am able to successfully access the db and execute queries through a java APPLICATION.
I need to do the same (access the db (mysql)) through a java APPLET. When I compile the applet it complies fine. When I try to run the applet I'm getting the following error message:
java.lang.ClassNotFoundException: com.mysql.jdbc.Driver
I tied running the applet using appletviewer and through a web browser, same result. I can run the application from the same command prompt it works fine.
Please help.
Relevant info:
OS: Linux, Fedora4
Classpath: export set CLASSPATH=/home/xyz/Java/mysql-connector-java-5.0.5/:$CLASSPATH;
JDK: PATH=/usr/java/jdk1.6.0/bin
Program:
import java.sql.*;
public class b extends java.applet.Applet
     int y = 0;
public void paint(java.awt.Graphics g)
          y = y + 10;
Connection conn = null;
String driver = "com.mysql.jdbc.Driver";
String url = "jdbc:mysql://localhost:3306/testdb?user=usr1234&password=xyzxyz";
try {
     Class.forName(driver).newInstance();
     conn = DriverManager.getConnection(url);
     System.out.println("Connected to the database.");
     System.out.println(" ");
     //*********BLOCK TO RETRIEVE RECORDS FROM TABLE*********
               try{
                    Statement st = conn.createStatement();
                    ResultSet res = st.executeQuery("SELECT * FROM table1");
                    System.out.println("Name: " + "\t" + "Age: ");
                    while (res.next()) {
                         String s = res.getString("name");
                         int i = res.getInt("age");
                         System.out.println(s + "\t" + i);
               catch (SQLException s){
          y = y + 20;
g.drawString("******* s: "+s,50,y);
     //*********END OF BLOCK TO RETRIEVE RECORDS FROM TABLE*********
     conn.close();
     System.out.println("Disconnected from database");
     }      catch (Exception e) {
          y = y + 20;
g.drawString("******* e: "+e,50,y);
               e.printStackTrace();
Thanks for the help in advance.
--Mat

First, accessing a database from an applet is a horrendous idea.
Having said that, did you add the mysql jar to the applet tag in the html page (in the archive property)?

RemoteApp rdp file connection restriction

Hi all,
So I have a RemoteApp deployment that gives users certain applications from the RDWeb site based on security groups. I've connected a few people using the RemoteApp and Desktop Connections in Control Panel on their Win7 workstations. I've noticed that these
users can retrieve the rdp file from their C:\Users\<user profile>\AppData\Roaming\Microsoft\Workspaces\{XXX}\Resource\ and pass around the rdp file which would bypass the security groups configured in the RDWeb site if they were to connect to the
RDWeb site. Is there a way to restrict the user from the application based on a security group if they were to connect using a retrieved rdp file?
Thanks
Victor

Hi Victor,
For your case, can’t find no such restriction policy. You need to apply RemoteApp User Assignment for the user and provide the access. If it’s like RDP file access then you can manually add the username and password under that RDP file so that only that user
can access the application. And if RDP file is to connect to server then you can restrict the user on server side to get access. After all it depends on your requirement.
You can check the below article for information.
Introducing RemoteApp User Assignment
http://blogs.msdn.com/b/rds/archive/2009/06/12/introducing-remoteapp-user-assignment.aspx
Hope it helps!
Thanks.
Dharmesh Solanki
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

Untrusted Applet Connection Restrictions

Similar Messages

Maybe you are looking for