File APIs for Java Developers
Manipulate DOC, XLS, PPT, PDF and many others from your application.
The moose likes Applets and the fly likes JApplet Browser security issues Big Moose Saloon
  Search | Java FAQ | Recent Topics | Flagged Topics | Hot Topics | Zero Replies
Register / Login
JavaRanch » Java Forums » Java » Applets
Bookmark "JApplet Browser security issues" Watch "JApplet Browser security issues" New topic

JApplet Browser security issues

mark weatherill

Joined: Jan 21, 2006
Posts: 6

I've written a game JApplet which uses 3rd party image gifs and jpgs embedded in JLabels / JButtons. Trouble is when I try to browse my Japplet, I get security exceptions left, right & centre becuse it won't allow the JApplet to read external files, even on my local machine!
The only solutions I can think of are twofold:
1. use public / private key encryption (messy), or
2. use custom graphics routines
Are these the only viable solutions, or is there a more elegant answer out there somewhere in Javaspace?!
Ulf Dittmer

Joined: Mar 22, 2005
Posts: 42965
Welcome to JavaRanch.

You seem to load the image files from your local hard disk. Why don't you keep them in your web directory alongside the applet? That way the applet is allowed access to them with no special setup.
Ulf Dittmer

Joined: Mar 22, 2005
Posts: 42965
Response from Mark:
Allow me to elaborate on the problem i'm having:
i've written a game JApplet which uses 3rd party gif's & jpg's. When testing it using appletviewer there were no problems, but when i tried testing it with a browser (IE6), the following occurs: in the status bar i get this message: "Applet MasterMind not inited" and a big red X in the top left-hand corner of the browser window.

Then, looking in the Java Console, i see this error: access denied ( mastermindchair.jpg read)

All the image files needed by the applet are located in the same directory as the compiled class files. The html to trigger the applet is in the same directory:
<applet code="MasterMind.class" width=800 height=750 alt="JVM deactivated."></applet>
Tonight, i tried lowering the security level of my browser to nil, and it still refuses to start it, always reporting the errors mentioned above. I can't understand why i can't get my machine's browser to fire up the applet , especially when i have set the security to virtually zero. BTW, i also tried using Netscape, with the same results. Any suggestions gratefully received...

The browser security settings have no bearing on this - it's the applet security settings that prohibit it. Applets can't open files (or use anything in the package, and a number of other things). The appletviewer is special in this regard, as it generally doesn't enforce these restrictions; but browsers do.

There are three ways around this. Either relax the security policy for applets on your machine, or digitally sign the applet, or load the images in a way the applet is allowed to do. The first two methods are described in this FAQ page. The third one has a short blurb and link pointing to further information on the Applet FAQ page.
[ February 07, 2006: Message edited by: Ulf Dittmer ]
mark weatherill

Joined: Jan 21, 2006
Posts: 6
Hi Ulf

I got it all working now; for a totally sublime Java Swing Mastermind gaming experiance, browse over to and follow the link to the Mastermind game.
Basically, I did the following:
1) Changed the ImageIcon constructors' argument from a string to a URL object ref.
2) Created keys & certificate using the JDK's keytool.
3) Exported the self-certified X.509 certificate and then imported it into the cacerts keystore on my local file system, also using keytool.
4) Signed the jar file using jarsigner.
5) Uploaded the signed jar file and all the image files to the server.
And it now works.
Thanks for your advice!
I agree. Here's the link:
subject: JApplet Browser security issues
It's not a secret anymore!