Skip to main content

How to deploy an applet using JNLP

3 replies [Last post]
hjyanghj
Offline
Joined: 2010-02-24
Points: 0

From Java tutorial >Deploying an Applet
(http://java.sun.com/docs/books/tutorial/deployment/applet/deployingApple...), I download the source code applet_ComponentArch_DynamicTreeDemo.zip.

After unzip, in subdirectory build/classes, using command
"jar cvf DynamicTreeDemo.jar appletComponentArch", I created the file DynamicTreeDemo.jar.

Now in build/classes, we have five files: AppletPage.html, AppletPage_WithAppletTagNoJNLP.html, AppletPage_WithAppletTagUsingJNLP, dynamictree-applet.jnlp, DynamicTreeDemo.jar.

My OS is Windows Vista Home Premium, browser is IE8.

1. In IE, File>Open and browse to AppletPage.html, every thing is OK as expected.
2. If I copy the above five files to form a web application with name TestApplet, in IE I navigate to http://localhost/TestApplet/AppletPage.html, I got error. Following is the error message:
============
JNLP file error: dynamictree-applet.jnlp. Please make sure the file exists and check if "codebase" and "href" in the JNLP file are correct.
java.io.FileNotFoundException: JNLP file error: dynamictree-applet.jnlp. Please make sure the file exists and check if "codebase" and "href" in the JNLP file are correct.
at sun.plugin2.applet.JNLP2Manager.loadJarFiles(Unknown Source)
at sun.plugin2.applet.Plugin2Manager$AppletExecutionRunnable.run(Unknown Source)
at java.lang.Thread.run(Unknown Source)
Exception: java.io.FileNotFoundException: JNLP file error: dynamictree-applet.jnlp. Please make sure the file exists and check if "codebase" and "href" in the JNLP file are correct.
===============
3. If I rename file "dynamictree-applet.jnlp" as "dynamictree-applet.txt". And in file AppletPage.html, change
"var parameters = {jnlp_href: 'dynamictree-applet.jnlp'} ; " to "var parameters = {jnlp_href: 'dynamictree-applet.txt'} ; ". Then navigate to http://localhost/TestApplet/AppletPage.html, every thing is OK as expected.

4. Althogh step 3 seems OK, the contents of dynamictree-applet.txt can be accesed by users and users know the filename DynamicTreeDemo.jar and can download it. It seems a security issue.

How to fix it.

HJY

Reply viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.
qu0ll
Offline
Joined: 2006-12-09
Points: 0

I don't understand why you needed to rename your JNLP file but as for the "security issue", anything which is available to your web browser is available to the general public otherwise you wouldn't be able to access it. Yes, users can download your JAR files, there's no way to stop that. The only protection you can provide is obfuscation but even then a decent decompilation tool will get around that.

-Qu0ll

hjyanghj
Offline
Joined: 2010-02-24
Points: 0

Qu0ll ,
Thanks a lot.

Now I know I need to setup MIME type in my IIS with
.jnlp -> application/x-java-jnlp-file

qu0ll
Offline
Joined: 2006-12-09
Points: 0

No worries. The problem is even worse for JavaScript developers because their scripts are there for all the world to see in a human-readable form. Of course some resort to obfuscation for JavaScript too but at least the Java code is compiled!

-Qu0ll