|
This section describes the basics of security for applications deployed through Java Web Start and includes:
Java Web Start verifies that the contents of the JAR file have not changed since it was signed. If verification of a digital signature fails, Java Web Start does not run the application.
When the user first runs an application as a signed JAR file, Java Web Start opens a dialog box displaying the application's origin based on the signer's certificate. The user can then make an informed decision regarding running the application.
For more information, see the Signing and Verifying JAR Files section.
security element contains security settings for the application.
The following example provides the application with complete access to the client system if all its JAR files are signed:
<security> <all-permissions/> </security>
https handler, using the java.protocol.handler.pkgs system properties, to initialize defaults for the
SSLSocketFactory and
HostnameVerifier. It sets the defaults with the methods
HttpsURLConnection.setDefaultSSLSocketFactory and
HttpsURLConnection.setDefaultHostnameVerifier.
If your application uses these two methods, ensure that they are invoked after the Java Web Start initializes the https handler, otherwise your custom handler will be replaced by the Java Web Start default handler.
You can ensure that your own customized SSLSocketFactory and HostnameVerifiter are used by doing one of the following:
https handler, to replace the Java Web Start https handler. For more information, see the document
A New Era for Java Protocol Handlers.
HttpsURLConnection.setDefaultSSLSocketFactory or HttpsURLConnection.setDefaultHostnameVerifier only after the first https URL object is created, which executes the Java Web Start https handler initialization code first.
|
