How to detect if any exe application is installed on client machine through browser

[Neeraj jain]

I am working on SpringMVC web application.
Is there any way to detect from browser(jsp page) that any (exe) application is installed or not on client machine? And if not installed then show user the Popup to download that Application or Software .
and if the user rejects to download that application then not allow him/her to login

[Bear Bibeault]

No. And certainly not with JSP, which runs on the server.

Perhaps (just perhaps) it could be done with a signed applet; but most people have Java turned off in the browsers -- and most browsers have it disabled by default -- so even if that was able to work, it might not be the best approach.

Since you mention exe files, I assume you are concerned only with Windows, in which case, there may be a proprietary way of doing this in IE. I wouldn't know for sure.

In any case, if the exe program is needed to run your application just tell people that they need to download and install it if they are going to use your system. They can choose to follow the instructions or not as they please.

[Neeraj jain]

In any case, if the exe program is needed to run your application just tell people that they need to download and install it if they are going to use your system. They can choose to follow the instructions or not as they please.

Hello Bear Bibeault ,
I want whenever user login to my web page , he/she needs to install a software, and for that i will provide a popup link to download that software but if a user has already have that software so why he/she should need to download it ,that is why I need some way to check if software is preinstalled into client's machine ,

P.S. --> Can't we do it in a way we check that cookies are enabled into the client machine or not ?

[Bear Bibeault]

No. Imagine the security implications if any web site could start poking around in the file system of your computer.

Barring any client-side trusted agent (the aforementioned signed applet or IE extensions) you'll likely need to ask users to install the software.

[Bear Bibeault]

If it were me designing this, I'd likely do something like the following:

When the local program starts, it would ask the user to log in and contact the DB and write a record that records that the user has installed and run the software. This would be a one-time action when the program starts for the 1st time.

When a user logs into the web app, it would check to see of the record exists. If so, proceed as normal. If not, it would direct them to an instructional page where they could download the program and read the privacy policy and other policies regarding the program.

[Bear Bibeault]

P.S. Depending upon your audience, you should expect a large number of people to refuse to install local programs. I know I would not install anything on my system that's not from a very very trusted source and for which there was a clearly spelled out privacy policy regarding what the program is allowed to do while running on my system.

[Ulf Dittmer]

When the local program starts, it would ask the user to log in and contact the DB and write a record that records that the user has installed and run the software.

That would only work for the machine the user used that time, though - which may or may not be an acceptable restriction. A solution involving setting a cookie would help getting it right for all machines. If the cookie was missing later for some reason, worst thing that would happen is that the installer would run again when the app is actually already installed on a machine - a situation a decent installer should be able to handle gracefully.

you should expect a large number of people to refuse to install local programs.

Given that a client relationship was mentioned I suspect that may not be the case.

[Bear Bibeault]

Ulf Dittmer wrote:

When the local program starts, it would ask the user to log in and contact the DB and write a record that records that the user has installed and run the software.

That would only work for the machine the user used that time, though

No, I was thinking that the record would be tied to the user's login, which would be machine independent.

you should expect a large number of people to refuse to install local programs.

Given that a client relationship was mentioned I suspect that may not be the case.

Yes, that's why I prefaced with "depending upon audience". A trusting client will have a much different attitude than a more general yet-to-be-a-client.

[Neeraj jain]

Bear Bibeault wrote:If it were me designing this, I'd likely do something like the following:

When the local program starts, it would ask the user to log in and contact the DB and write a record that records that the user has installed and run the software. This would be a one-time action when the program starts for the 1st time.

When a user logs into the web app, it would check to see of the record exists. If so, proceed as normal. If not, it would direct them to an instructional page where they could download the program and read the privacy policy and other policies regarding the program.

Hii Bear Bibeault,
but the problem with this solution is that suppose for the first time i logged in and at that time pop up appears to install the software and i download that and after downloading , The database entry is changed to downloaded , but before logging next time i uninstalled the software and at the time of login DB will reflect the status to downloaded but in actual the software is not into client machine so That would be a problem . Don't you think ?

[Bear Bibeault]

Perhaps, but you can't police bad behavior on the part of the client. If they want to use your system, they need to install (and not uninstall) the program.

It's a similar situation to web apps I create -- they require a modern browser. If you want to use the app, you use a modern browser. If you insist on using IE8, then you don't get to use the web app.

But again, without some trusted agent (signed applet, ActiveX or some other IE thingy) your web app cannot access the file system to see what is installed or not.

[Neeraj jain]

ok , but how can we check that ActiveX plugin is installed in the browser and moreover how to use it to get the client machines MAC Address.

[Ulf Dittmer]

I think we're getting lost in details, and I'm not clear how those are related to the issue at hand. Can we take a step back, and you start by telling us what the connection between that app and your web app is. Why shouldn't the user use the web app if he hasn't installed the native app? What does the client's MAC address have to do with it?

[Bear Bibeault]

Good questions, Ulf. Seemed odd to me from the start. And, yeah, MAC address?

[Neeraj jain]

Ulf Dittmer wrote:I think we're getting lost in details, and I'm not clear how those are related to the issue at hand. Can we take a step back, and you start by telling us what the connection between that app and your web app is. Why shouldn't the user use the web app if he hasn't installed the native app? What does the client's MAC address have to do with it?

ULF , I have some kind off scenario that i needs to provide access to 1 user only through a 1 particular system , So for that purpose I need MAC Address which get confirmed from the DB entry if it matches then only user will be allowed to access the website , due to security reasons need to implement this kind off functionality.

[Bear Bibeault]

Is that whole reason for the exe? To obtain the MAC address? How is that going to tie into the web app?

Is this all just a licensing issue?

[Ulf Dittmer]

Why don't you give that one machine a static IP address -as unwelcome as that usually is- so you can identify it in the web app? Much better than any approach involving native code, IMO.

[Neeraj jain]

@ULF , ok i will try that out . thanks to all