Signed applet security considerations

Networking & Multiplayer
#1

I’m working on a small project and is considering moving some code from Flash to a signed Java Applet. Some security measures I’ve dug up are:

  • Checking the getDocumentBase() to prevent jar files from being hosted elsewere.
  • and using myObject.class.getProtectionDomain().getCodeSource().getLocation() to verify url.
    But I guess these are still useless when an iframe is used?

Are there any additional security measures I can make to make the applet safer to use?

#2

What do you mean by “safer” to use?

Cas :slight_smile:

#3

If I’m correct, you’re looking for some way to prevent people from embedding or framing your applet on other sites w/o permission, right?

  1. I don’t know that this is such a huge concern. It happens a lot with Flash, true, but I don’t know that any Java games have had serious trouble with this. Has anyone here?
  2. It’s tough to prevent framing in general. However, there’s a trick you can use to bust out of a frame or an iframe, which is to use Javascript to promote your page to the top level if it’s not already there. Something like this (sorry, my Javascript is rusty, so this might not be exactly right):

<script>
if (window != top) {
  top.location.href=location.href;
}
</script>

I think that should go somewhere in the page header, I forget exactly where - try it out for yourself before you use it in practice. There are tricky ways people can get around that, but I don’t think most would bother.

#4

My concern with the applet is running with full system privileges when embedded inside a webpage and in my project there will be some communication between the applet and the webpage, so I’d like to limit access to the (hosted) signed jar file like preventing other from linking into into their own code. My knowledge with Java security is pretty limited so I sort of want to cover the basics. My project is a small experiment with a hosted graphics app and will use file access through java file dialogs (to avoid uploading data to my server and then download it back again, which is allowed in the webbrowser), but all file processing will be inside the applet and javascript will never specify files. This is the reason I want to limit “hotlinking” of the jar file.

ewjordan: yeah, javascript is a security nightmare in general if you use things like ads or if you’re not careful with data. :slight_smile: I guess some additional rules for apache can help against hotlinking also.

#5

full system privileges in the client system— No in your “web system”…

i use PHP to comunicate to database so applet can’t comunicate to database direct because security issues.

Applet —> PHP —>database

#6

Yes. I won’t be using any database though or server upload.