Download the JDK
Search the Tutorials
Hide the TOC
Trail: Deployment
Lesson: Java Web Start
Java Web Start
Running Java Web Start Applications
Deploying Java Web Start Applications
Developing Java Web Start Applications
The JNLP API
Java Web Start and Security
Common Java Web Start Problems
Questions and Exercises
Home Page > Deployment > Java Web Start
Java Web Start and Security

> This section describes the basics of security for applications deployed through Java Web Start and includes:
> - Java Web Start Security Basics
> - Signing JAR Files for Java Web Start Deployment
> - Security and JNLP Files
> - Dynamic Downloading of HTTPS Certificates

### Java Web Start Security Basics

> Applications launched with Java Web Start are, by default, run in a restricted environment, known as a sandbox. In this sandbox, Java Web Start:
> - Protects users against malicious code that could affect local files
> - Protects enterprises against code that could attempt to access or destroy data on networks
> Unsigned JAR files launched by Java Web Start remain in this sandbox, meaning they cannot access local files or the network.

### Signing JAR Files for Java Web Start Deployment

> Java Web Start supports signed JAR files so that your application can work outside of the sandbox described above, so that the application can access local files and the network.

> Java Web Start verifies that the contents of the JAR file have not changed since it was signed. If verification of a digital signature fails, Java Web Start does not run the application.

> When the user first runs an application as a signed JAR file, Java Web Start opens a dialog box displaying the application's origin based on the signer's certificate. The user can then make an informed decision regarding running the application.

> For more information, see the Signing and Verifying JAR Files section.

### Security and JNLP Files

> For a signed JAR file to have access to the local file system and network, you must specify security settings in the JNLP file. The `security` element contains security settings for the application.

> The following example provides the application with complete access to the client system if all its JAR files are signed:

> >     <security>
> >        <all-permissions/>
> >     </security>

### Dynamic Downloading of HTTPS Certificates

> Java Web Start dynamically imports certificates as browsers typically do. To do this, Java Web Start sets its own `https` handler, using the `java.protocol.handler.pkgs` system properties, to initialize defaults for the `SSLSocketFactory` and `HostnameVerifier` . It sets the defaults with the methods `HttpsURLConnection.setDefaultSSLSocketFactory` and `HttpsURLConnection.setDefaultHostnameVerifier` .

> If your application uses these two methods, ensure that they are invoked after the Java Web Start initializes the `https` handler, otherwise your custom handler will be replaced by the Java Web Start default handler.

> You can ensure that your own customized `SSLSocketFactory` and `HostnameVerifiter` are used by doing one of the following:

> - Install your own `https` handler, to replace the Java Web Start `https` handler. For more information, see the document A New Era for Java Protocol Handlers .
> - In your application, invoke `HttpsURLConnection.setDefaultSSLSocketFactory` or `HttpsURLConnection.setDefaultHostnameVerifier` only after the first `https URL` object is created, which executes the Java Web Start `https` handler initialization code first.

Previous page: The JNLP API
Next page: Common Java Web Start Problems