Offering a fallback on Applet Security Exception

Question

I have an Applet that is required to run with some privileges, meaning a warning message will be displayed when it loads. If the user denies the warning message I would like to redirect to an error page and explain what happened. Is there any way to do this?

I looked in to having a timer running and redirect after a certain time period but that's not that exact and it would be nice to catch the response from the pop-up instead.

The following exception is thrown if the user denies the warning:

java.lang.SecurityException: attempted to open sandboxed jar [jar-file] 
    as a Trusted-Library

The exception is thrown before reaching the init function.

Answer 1

I looked in to having a timer running and redirect after a certain time period ..

..extend that to add a JS function that cancels the timer, then call that JS from the applet, is about the best protection you can get.

A try/catch on security related matters can work for some JREs that load applet sand-boxed if the security prompt is refused, but other run-times (notably the Iced Tea JRE) will not load the applet at all if the security prompt is refused.

I have an Applet that is required to run with some privileges.. Basically we store a file there, the file can be any file and the size can therefore be any value. The user will choose this file themselves and they can choose anything from a 1kb textfile to a many-gigabyte movie. ..

If the user can be guaranteed to have a 'Next Generation' - Plug-In 2 JRE (mentioned in the applet info. page), it is possible to the use the JNLP API in an embedded applet. The JNLP services provide access to the local disks for a sand-boxed app. See this demo of the JNLP file services.

But there is a slight hitch. There is no option to persist the path to the file chosen by the user. In this lesser security environment, the JRE does not provide a File but instead a JNLP API FileContents object. It will not provide a path and is not serializable. But if the user is willing to choose the file each run, it could be workable.

---

..and that reminds me. Perhaps a better alternative for launching trusted apps. is to offer a free-floating (applet or) frame using Java Web Start. If the user refuses, it never appears on-screen, but they can click the launch button again any time they like (to be prompted again).