 | Web browsers allow downloaded Java applets to execute within a limited
context called the "applet sandbox". Applet's are not
allowed to access your local file system or network connections unless the applet is given
permission by a system administrator who creates a digital signature (ie:
signed applet aka trusted applet). |
| There have been major changes between Security in JDK 1.1 and
Java 2 JDK 1.2. JDK 1.3 & JDK 1.2 seems to be identical.
 | On version 1.1 of the Java platform, a trusted applet has the same
freedom to perform operations as a local application. On version 1.2
of the platform, a trusted applet would have freedoms as specified
by the policy file in force.
|
| JDK1.1 - "trusted applets" have permission like local
applications.
|
| JDK 1.2 use policy files for permissions. |
| JDK 1.3 use policy files for permissions. |
|
| JDK 1.1 Trusted Applets
Summary of process
| Signer signs the JAR file using a private key (use JavaKey.exe)
|
| You obtain a digital certificate from a "certification
authority" - companies that specializing in digital security
(like Verisign) |
| The Public key is placed in the JAR file along with a digital
certificate.
|
|
| JDK 1.2/1.3 Trusted Applets - depending on the browsers implementation of Java you will probably
need to load the Java Plug-in to be able to use JDK 1.2 policy files (ie:
IE 5 & NS 4). Netscape 6 implements the JDK 1.2 without a Java
Plug-In.
| Digital Certificates are not needed. (use keytool.exe &
jarsigner.exe) |
| Use PolicyTool.exe to create the policy files with the neccessary
permissions. |
|
| In Java2 JDK1.2, reading or writing a file, are not permitted for
applets unless explicitly allowed by a permission in a policy file.
JDK 1.1 is much harder to implement because your Applet must be digital
signed to be trusted. With JDK 1.2 you can also
apply security constraints to Java applications. |
| The Java™ 2 Standard Edition
Runtime Environment includes the Java Plug-In.
|
| With Java 2, you can configure the Java Plug-In via the control
panel's icon "Java Plug-In".
|
| You can optionally sign a JAR file with your electronic
"signature." Users who verify your signature can grant your
JAR-bundled software security privileges that it wouldn't ordinarily
have. Conversely, you can verify the signatures of signed JAR files that
you want to use.
|
