Java I/O

Security Issues

I don’t know if there’s one most frequently asked question about Java Network Programming, but there’s definitely a most frequent answer, and it applies to this book too. My mistake in Java Network Programming was hiding that answer in the back of a chapter most people didn’t read. Since that very same answer should answer an equal number of questions from readers of this book, I want to get it out of the way right up front:

Java’s security manager prevents almost all the examples and methods discussed in this book from working in an applet.

This book focuses very much on applications. There is very little that can be done with I/O from an untrusted applet without running afoul of the security manager. The problem may not always be obvious—not all web browsers properly report security exceptions—but it is there.

There are some exceptions. Byte array streams and piped streams work without limitation in applets. Network connections can be made back to the host from whence the applet came (and only to that host). System.in and System.out may be accessible from some, though not all, web browsers. And in Java 2 and later, there are ways to relax the restrictions on applets so they get limited access to the filesystem or unlimited access to the network. However, these are exceptions, not the rule.

If you can make an applet work when run as a standalone application and you cannot get it to work inside a web browser, the problem is almost certainly a conflict with the browser’s security manager.