Java applet security warning for application involving disk read

Question

I have a java applet that is downloaded to a user's browser when they visit a webpage and allows them resumable file uploads to my server. Obviously, this requires the applet to access the user's hard disk, which I understand is outside the regular sandbox applets can run in. The user sees a security warning popup which asks for their permission to allow this applet to run.

I have signed the applet using verisign and the link from where is applet is fetched is over SSL with a versigned cert. None of these make the warning go away.

Is there a way to make all warnings go away? Can anyone explain what is going on behind the scenes?

Answer 1

You can't avoid this message, it would be a security issue if you could.

Granting Applets Permission

If you tried to run the applet example, you undoubtedly saw errors when you clicked the Click Me button. This is because the Java 2 Platform security does not permit an applet to write to and read from files without explicit permission.

An applet has no access to local system resources unless it is specifically granted the access. So for the FileUIAppl program to read from text.txt and write to text.txt, the applet has to be given the appropriate read or write access permission for each file.

Access permission is granted with a policy file, and appletviewer is launched with the policy file to be used for the applet being viewed.

What you can do is having a configuration (a policy file) to allow this applet to use some files. But you would have to do this manually (for obvious security reasons). Check the link below.

---

Resources :

• sun.com - Applets, File Access and Permissions

Answer 2

JNLP has a FileOpenService which allows the untrusted Java Webstart applications to show a File Open dialog to the user and access the file the user selected:

http://download-llnw.oracle.com/javase/1.5.0/docs/guide/javaws/jnlp/javax/jnlp/FileOpenService.html