Applet requests crossdomain.xml

Question

I have web server (IBM Domino), that is using 2 hostnames, because of two different authentication methods. Both serve same application that contain a Java applet that does image upload to a servlet.

Problem is that for one hostname it requires crossdomain.xml even when the response goes back to same server. Below is log from Java Console

security: Certificate has been verified with Internet Explorer ROOT certificates successfully
security: Valid certificate from HTTPS server
security: Adding certificate in Deployment session certificate store
security: Added certificate in Deployment session certificate store
security: Saving certificates in Deployment session certificate store
security: Saved certificates in Deployment session certificate store
network: Connecting https://v8lnprox1-sso.pradny.com/lwf/hd.nsf/test.jar with cookie "SessionID=DICYCB6XKY; LtpaToken=AAECAzUxQzgzMjJDNTFDOTgzQUNDTj1Ob3RlcyBEZXNpZ24vTz1QTUIvQz1DWi2qxrRR+Cf/ZLIyNcL5C2MYFyO/"
network: ResponseCode for https://v8lnprox1-sso.pradny.com/lwf/hd.nsf/test.jar : 304
network: Encoding for https://v8lnprox1-sso.pradny.com/lwf/hd.nsf/test.jar : null
network: Disconnect connection to https://v8lnprox1-sso.pradny.com/lwf/hd.nsf/test.jar
cache: Reading Signers from 4633 https://v8lnprox1-sso.pradny.com/lwf/hd.nsf/test.jar | C:\Documents and Settings\exmartin\Data aplikací\Sun\Java\Deployment\cache\6.0\32\4961f60-2fd2a536.idx
cache:  Read manifest for https://v8lnprox1-sso.pradny.com/lwf/hd.nsf/test.jar: read=241 full=241
basic: Plugin2ClassLoader.getPermissions CeilingPolicy allPerms
security: Loading Root CA certificates from C:\Program Files\Java\jre6\lib\security\cacerts
security: Loaded Root CA certificates from C:\Program Files\Java\jre6\lib\security\cacerts
security: Loading Deployment certificates from C:\Documents and Settings\exmartin\Data aplikací\Sun\Java\Deployment\security\trusted.certs
security: Loaded Deployment certificates from C:\Documents and Settings\exmartin\Data aplikací\Sun\Java\Deployment\security\trusted.certs
security: Loading certificates from Deployment session certificate store
security: Loaded certificates from Deployment session certificate store
security: Loading certificates from Internet Explorer ROOT certificate store
security: Loaded certificates from Internet Explorer ROOT certificate store
security: Loading certificates from Internet Explorer TrustedPublisher certificate store
security: Loaded certificates from Internet Explorer TrustedPublisher certificate store
security: Validate the certificate chain using CertPath API
security: Obtain certificate collection in Root CA certificate store
security: Obtain certificate collection in Root CA certificate store
security: No timestamping info available
security: Found jurisdiction list file
security: Start checking trusted extension for this certificate
security: Start comparing to jurisdiction list with this certificate
security: The CRL support is disabled
security: The OCSP support is disabled
security: This OCSP End Entity validation is disabled
security: Checking if certificate is in Deployment denied certificate store
security: Checking if certificate is in Deployment permanent certificate store
basic: Applet loaded.s
basic: Applet resized and added to parent container
basic: PERF: AppletExecutionRunnable - applet.init() BEGIN ; jvmLaunch dt 263251 us, pluginInit dt 4145344 us, TotalTime: 4408595 us
basic: Applet initialized
basic: Removed progress listener: sun.plugin.util.GrayBoxPainter$GrayBoxProgressListener@1dff3a2
basic: Applet made visible
basic: Starting applet
basic: completed perf rollup
basic: Applet started
basic: Told clients applet is started
SERVERhttp://v8lnprox1-sso.pradny.com/servlet/imgPaste?lnid=C12579B50053D943@F3B5BDE9E7B4E2F4C1257B94003D0AEB10eyr0f4mw4cg&category=imgPozadavek&userName=CN%3DNotes%20Design/O%3DPMB/C%3DCZ
class java.io.InputStream
1
2
3
4
5
network: Connecting http://v8lnprox1-sso.pradny.com/servlet/imgPaste?lnid=C12579B50053D943@F3B5BDE9E7B4E2F4C1257B94003D0AEB10eyr0f4mw4cg&category=imgPozadavek&userName=CN%3DNotes%20Design/O%3DXXX/C%3DCZ with proxy=DIRECT
network: Cache entry not found [url: http://172.27.40.228/crossdomain.xml, version: null]
network: Connecting http://172.27.40.228/crossdomain.xml with proxy=DIRECT
network: Connecting http://172.27.40.228:80/ with proxy=DIRECT

If I add crossdomain.xml file it works fine, but I don't think it should be required.

For both hostnames we post data to http address even when the app works over https, because we had problems with applet and https in past.

Stripped down version from second hostname that works fine withou crossdomain.xml

network: Connecting https://v8lnprox1.pradny.com/lwf/hd.nsf/test.jar with cookie "SessionID=DICYID8LJR; DomAuthSessId=DC524501EBA6503AB01FC5C61D8DA887"
network: CleanupThread used 3 us
network: Downloading resource: https://v8lnprox1.pradny.com/lwf/hd.nsf/test.jar
    Content-Length: 7 630
    Content-Encoding: null
network: Wrote URL https://v8lnprox1.pradny.com/lwf/hd.nsf/test.jar to File C:\Documents and Settings\exmartin\Data aplikací\Sun\Java\Deployment\cache\6.0\19\537eb3d3-1edda6c2-temp


SERVERhttp://v8lnprox1.pradny.com/servlet/imgPaste?lnid=C12579B50053D943@F3B5BDE9E7B4E2F4C1257B94003D0AEB10eyr0f4mw4cg&category=imgPozadavek&userName=CN%3DNotes%20Design/O%3DPMB/C%3DCZ
class java.io.InputStream
1
2
3
4
5
network: Connecting http://v8lnprox1.pradny.com/servlet/imgPaste?lnid=C12579B50053D943@F3B5BDE9E7B4E2F4C1257B94003D0AEB10eyr0f4mw4cg&category=imgPozadavek&userName=CN%3DNotes%20Design/O%3DXXX/C%3DCZ with proxy=DIRECT
network: Connecting http://v8lnprox1.pradny.com:80/ with proxy=DIRECT
6
network: Connecting http://v8lnprox1.pradny.com/servlet/imgPaste?lnid=C12579B50053D943@F3B5BDE9E7B4E2F4C1257B94003D0AEB10eyr0f4mw4cg&category=imgPozadavek&userName=CN%3DNotes%20Design/O%3DXXX/C%3DCZ with cookie "SessionID=DICYID8LJR; DomAuthSessId=DC524501EBA6503AB01FC5C61D8DA887"
7
Nacteno bytu: 527412

Any idea what can cause the difference? (tested on Java 1.6u34)

Answer 1

The release notes for java 6 update 22 say:

CVE-2010-3560

The fix for CVE-2010-3560 could cause certain Java applets running in the new Java Plug-in to stop working if they are embedded in web pages which contain JavaScript that calls into Java in order to perform actions which require network security permissions. These applets may fail with a network security exception under some circumstances if the name service which resolved the original web page URL host name does not return a matching name as the result of a reverse address lookup. [...]

Could it be that the plugin does a reverse lookup for the originating server's IP address, discovers a different hostname, and therefore decides it's a cross-domain request?