Java Web Start and Security (The Java™ Tutorials > Deployment

This section describes the basics of security for applications deployed through Java Web Start and includes:

Java Web Start Security Basics

Signing JAR Files for Java Web Start Deployment

Security and JNLP Files

Dynamic Downloading of HTTPS Certificates

Java Web Start Security Basics

Applications launched with Java Web Start are, by default, run in a restricted environment, known as a sandbox. In this sandbox, Java Web Start:

Protects users against malicious code that could affect local files

Protects enterprises against code that could attempt to access or destroy data on networks

Unsigned JAR files launched by Java Web Start remain in this sandbox, meaning they cannot access local files or the network.

Signing JAR Files for Java Web Start Deployment

Java Web Start supports signed JAR files so that your application can work outside of the sandbox described above, so that the application can access local files and the network.
Java Web Start verifies that the contents of the JAR file have not changed since it was signed. If verification of a digital signature fails, Java Web Start does not run the application.
When the user first runs an application as a signed JAR file, Java Web Start opens a dialog box displaying the application's origin based on the signer's certificate. The user can then make an informed decision regarding running the application.
For more information, see the Signing and Verifying JAR Files section.

Security and JNLP Files

For a signed JAR file to have access to the local file system and network, you must specify security settings in the JNLP file. The security element contains security settings for the application.
The following example provides the application with complete access to the client system if all its JAR files are signed:
<security>
   <all-permissions/>
</security> 

Dynamic Downloading of HTTPS Certificates

Java Web Start dynamically imports certificates as browsers typically do. To do this, Java Web Start sets its own https handler, using the java.protocol.handler.pkgs system properties, to initialize defaults for the SSLSocketFactory and HostnameVerifier . It sets the defaults with the methods HttpsURLConnection.setDefaultSSLSocketFactory and HttpsURLConnection.setDefaultHostnameVerifier .
If your application uses these two methods, ensure that they are invoked after the Java Web Start initializes the https handler, otherwise your custom handler will be replaced by the Java Web Start default handler.
You can ensure that your own customized SSLSocketFactory and HostnameVerifiter are used by doing one of the following:

Install your own https handler, to replace the Java Web Start https handler. For more information, see the document A New Era for Java Protocol Handlers .

In your application, invoke HttpsURLConnection.setDefaultSSLSocketFactory or HttpsURLConnection.setDefaultHostnameVerifier only after the first https URL object is created, which executes the Java Web Start https handler initialization code first.