Sunday, November 23, 2014

Applet Security warning popup issue, removing live connect calls.

removing live-connect dependency from web pages containing applets.

I was using jre7u21, for some reason had to move to on update (jre7u45), it has introduced some serious security restriction on applet side, one of  the impact is live-connect(javascript to applet) calls. As per documentation here 
  • The JavaScript to Java (LiveConnect) security dialog prompt is shown once per Applet classLoader instance.
So what does it mean for us? why do we care first of all.  we don't have to worry until ..
  1. we are fine with older version of jre (older than jre7u45). 
  2. we can afford to our customer giving interface with annoying security warning popup.
  3. we can configure java security verification (default is "show warning if needed)(control panel -> java -> advance tab)
In short we may have to get rid of live connect (javascript to applet) calls if we want to use latest jre, I personally do not prefer applets as its insecure, but  for legacy code base we have to come up with some short of alternative to avoid security warning popup. Here I am going to explain the approach I have followed.

The idea is that security warning popup appears when there is a javascript to java(applet) call, but there is no issue if applet calls to javascript, so we can safely call from applet to javascript. So my approach is to have one thread per applet which will keep on looking if there is any call from javascript, in javascript we can maintain one method call queue and the applet-thread will keep on polling for any method call in queue, if there is method call then applet-thread will invoke the method on itself through reflection.

Search Ranjeet's Blog