Java applet issue with manifest attributes from Java7&8

Question

My application will show documents using java applet viewer and it is working perfectly with Java6. From Java7 and above version, i am not able to view the docs as applet is failing to load the doc. The attributes, which i am using is mentioned below. Could any one suggest me the changes required if any

ANT script:

<target name="build.applet.manifest">
    <tstamp>
        <format property="build.time" pattern="MMMM dd yyyy" />
    </tstamp>

    <manifest file="${vfiles}/work/MANIFEST.MF">
        <attribute name="Built-By" value="${user.name}" />
        <attribute name="Class-Path" value="" />
        <attribute name="Trusted-Library" value="true" />
        <attribute name="Permissions" value="all-permissions" />
        <attribute name="Codebase" value="*" />
        <attribute name="Application-Name" value="${product.cea}" />
        <attribute name="Caller-Allowable-Codebase" value="*.com *.net" />
        <attribute name="Application-Library-Allowable-Codebase" value="*" />
        <attribute name="Implementation-Vendor" value="${imp-vendor}" />
        <attribute name="Implementation-Title" value="${product.cea}" />
        <attribute name="Implementation-Version" value="${project.version} build ${buildNumber} ${build.time}" />
    </manifest>
</target>

Java console output:

network: Cache entry found [url: http://11.22.33.44:8080/myapplication_penn/mudoc/image/redact-view_disabled.png, version: null] prevalidated=false/0
cache: Adding MemoryCache entry: http://11.22.33.44:8080/myapplication_penn/mudoc/image/redact-view_disabled.png
cache: Resource http://11.22.33.44:8080/myapplication_penn/mudoc/image/redact-view_disabled.png has expired.
network: Connecting http://11.22.33.44:8080/myapplication_penn/mudoc/image/redact-view_disabled.png with proxy=DIRECT
network: Connecting http://11.22.33.44:8080/myapplication_penn/mudoc/image/redact-view_disabled.png with cookie "JSESSIONID=7567CD6257EE33B405C94F2C4B14EAE0"
network: ResponseCode for http://11.22.33.44:8080/myapplication_penn/mudoc/image/redact-view_disabled.png : 304
network: Encoding for http://11.22.33.44:8080/myapplication_penn/mudoc/image/redact-view_disabled.png : null
network: Disconnect connection to http://11.22.33.44:8080/myapplication_penn/mudoc/image/redact-view_disabled.png
cache: registerReference:com.sun.deploy.cache.MemoryCache$CachedResourceReference@a86d6866: 1
 liveconnect: Security Exception: JavaScript from             http://11.22.33.44:8080/myapplication_penn/daeja/show?CwI4rkFs%2FPfsP3Iv9TKaY6kyx3ki8t4UTxVQFbMj7Bx9V7QRa%2BKhCKhvOKvd7oKUIHoTjWvV9GdnZJQzjDR%2FNtR6%2B3%2Bkud0dI%2FQIh3J%2FrSIkctHBhAiV7mkZH0uCuty0 attempted to access a resource it has no rights to. -a1> 4 ji.v1event.k$a -a1 - jiDocumentEvents 15 Sep 2015, 15:58:13, IST (000000000/000000000): Error processing : null
netscape.javascript.JSException: JavaScript error while calling "handleEvent"
            at sun.plugin2.main.client.MessagePassingJSObject.newJSException(Unknown Source)
            at sun.plugin2.main.client.MessagePassingJSObject.waitForReply(Unknown Source)
            at sun.plugin2.main.client.MessagePassingJSObject.call(Unknown Source)
            at ji.applet.support.d.a(Unknown Source)
            at ji.applet.support.d.a(Unknown Source)
            at ji.applet.ViewONE_AppletImpl.a(Unknown Source)
            at ji.applet.ViewONE_AppletImpl.b(Unknown Source)
            at ji.applet.ViewONE_AppletImpl.javaScriptUpdate(Unknown Source)
            at ji.document.t.b(Unknown Source)
            at ji.document.t.a(Unknown Source)
            at ji.v1event.k.c(Unknown Source)
            at ji.v1event.k.a(Unknown Source)
            at ji.v1event.k$a.a(Unknown Source)
            at ji.v1event.k$a.run(Unknown Source)
            at java.lang.Thread.run(Unknown Source)
            at ji.awt.y.run(Unknown Source)
network: Cache entry found [url: http://11.22.33.44:8080/myapplication_penn/mudoc/image/annot-prev_enabled.png, version: null] prevalidated=false/0
cache: Adding MemoryCache entry: http://11.22.33.44:8080/myapplication_penn/mudoc/image/annot-prev_enabled.png
cache: Resource http://11.22.33.44:8080/myapplication_penn/mudoc/image/annot-prev_enabled.png has expired.
network: Connecting http://11.22.33.44:8080/myapplication_penn/mudoc/image/annot-prev_enabled.png with proxy=DIRECT
network: Connecting http://11.22.33.44:8080/myapplication_penn/mudoc/image/annot-prev_enabled.png with cookie "JSESSIONID=7567CD6257EE33B405C94F2C4B14EAE0"
network: ResponseCode for http://11.22.33.44:8080/myapplication_penn/mudoc/image/annot-prev_enabled.png : 304
network: Encoding for http://11.22.33.44:8080/myapplication_penn/mudoc/image/annot-prev_enabled.png : null
network: Disconnect connection to http://11.22.33.44:8080/myapplication_penn/mudoc/image/annot-prev_enabled.png
 cache: registerReference: com.sun.deploy.cache.MemoryCache$CachedResourceReference@4b156f58: 1
network: Cache entry found [url: http://11.22.33.44:8080/myapplication_penn/mudoc/image/annot-prev_disabled.png, version: null] prevalidated=false/0
cache: Adding MemoryCache entry: http://11.22.33.44:8080/myapplication_penn/mudoc/image/annot-prev_disabled.png
cache: Resource http://11.22.33.44:8080/myapplication_penn/mudoc/image/annot-prev_disabled.png has expired.
network: Connecting http://11.22.33.44:8080/myapplication_penn/mudoc/image/annot-prev_disabled.png with proxy=DIRECT
network: Connecting http://11.22.33.44:8080/myapplication_penn/mudoc/image/annot-prev_disabled.png with cookie "JSESSIONID=7567CD6257EE33B405C94F2C4B14EAE0"
network: ResponseCode for http://11.22.33.44:8080/myapplication_penn/mudoc/image/annot-prev_disabled.png : 304
network: Encoding for http://11.22.33.44:8080/myapplication_penn/mudoc/image/annot-prev_disabled.png :  null
network: Disconnect connection to http://11.22.33.44:8080/myapplication_penn/mudoc/image/annot-prev_disabled.png
cache: registerReference:         com.sun.deploy.cache.MemoryCache$CachedResourceReference@286491db: 1

Answer 1

From Oracle Java 7 docs

The Caller-Allowable-Codebase attribute is used to identify the domains from which JavaScript code can make calls to your RIA without security prompts.

You have *.com and *.net in your manifest while your are calling your applet from ip:8080. The error appears in the log.

As a short term fix you should include your IP in the attribute list in the manifest. As a long term fix you should really specify the domains that are trusted and run your applet from there.

FYI this attribute has been added to lower the risk of having your applet stolen and run from another website.