6

I have a signed applet on a website. Because of this, the Java security dialog appears, and the user needs to grant permission to the applet before it can do it's work. What I want to do is this:

  • I want the website to explain the security dialog box to the user before it comes up. The page will show some explanation text in a div, and after a few seconds, the security dialog will appear.
  • If the user already allowed the certificate in a previous session, it should just run the applet without any extra dialog.

The problem is that the security dialog appears as soon as the applet is embedded in the page. I can delay embedding, but there's no way to check it's permissions from the applet itself, since it needs to do it before it's loaded.

Perhaps I could load a second, normal applet that runs invisibly, and checks the permissions. But how would I go about doing that? Are there any Java classes that can check if a certificate has been trusted by the client?

Thanks.

1
  • As I know, the java security dialog appears only at the first applet launch. And if the user checks the box to Always trust the sertificate - the security dialog never appears again. But if the user chooses to trust it Once - it appears on the next launch. And you can't stop it programmatically for security reasons.
    – MockerTim
    May 5, 2011 at 7:39

1 Answer 1

0

You can check the certificate and signature of a JAR file programmaticly, just as the JVM would when loading the applet. It's not gonna be easy, but, at least at first glance, you're going to have to do this:

  1. Use a hidden applet to download your JARs and verify their certificates, like the applet viewer would. You can do this manually using the java.security.cert package. The best way to figure out how to do that was the JarSigner source code, especially the verifyJar(). Something like:

    // download the JAR
    URL url = new URL("jar:http://mywebsite.com/myjar.jar!/");
    JarURLConnection jarConnection = (JarURLConnection)url.openConnection();
    // get the certificates and other security stuff
    CodeSigners[] codeSigners = jarConnection.getJarEntry().getCodeSigners();
    Certificate[] certificates = jarConnection.getJarEntry().getCertificates();
    // verify the signatures
    // don't know the code, but you can analyze JarSigner example at http://download.oracle.com/javase/tutorial/security/toolfilex/rstep2.html
    
  2. Use LiveConnect (maybe something else?) to set a cookie so you know "if the user already allowed the certificate in a previous session".

  3. Launch your applet, possibly depending on the results of (1) stores in cookies created in (2).

I haven't give this that much thought, so there might be a better way. Good luck, and post back!

2
  • I thought JarSigner was only used to sign an applet? I couldn't find in the source how to access the end-users trusted certificates. I'm not too familiar with how certificates and keystores work, or even what exactly a keystore is. When I self signed my applet, I created a keystore on my development machine and ran JarSigner to sign it. When I deploy the applet on my website, the user chooses to accept or reject the permission request. Is that just an application setting, kind of like a 'remember my password' thing? Or is it being stored in a 'keystore' somewhere.
    – lifeformed
    May 5, 2011 at 17:35
  • @terence: The JarSigner code has methods for signing and verifying. The function verifyJar() does that. If you're not familiar with how keystores/certificates work, I highly recommend tutorials like Signed Applets and Verifying a Signature. Also, when you deploy an applet, the accept/reject is an application setting, but it's stored by the JVM, not you (not exactly sure where). Not the keystore; that only holds keys, not settings. May 19, 2011 at 12:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.