JDK-8157337 : Allow always checkbox in security dialog when jnlp location is unknown
  • Type: Enhancement
  • Component: deploy
  • Sub-Component: webstart
  • Affected Version: 8,9
  • Priority: P2
  • Status: Resolved
  • Resolution: Fixed
  • Submitted: 2016-05-19
  • Updated: 2017-05-16
  • Resolved: 2016-05-27
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 8 JDK 9
8u112Fixed 9 b124Fixed
Related Reports
Relates :  
Sub Tasks
JDK-8157720 :  
Description
The all-permissions security dialog will omit the "always trust" checkbox when the app is from multiple hosts, and the manifest of the main jar does not contain the appropriate Application Library Allowable Codebase attribute.
In the normal launching of a jnlp application with no href, the jnlp location is unknown, so we consider the app to be from multiple hosts (the host of the jar, and the "unknown" host of the jnlp file).
When we store the certificate in the permanent trust store for an app for which the "always trust" checkbox was checked by user, we include a string containing the locations of the jars and the jnlp file (or docbase for applets in the browser).
After discussion with the security team, it was agreed that if we store the hash of the "unknown location jnlp file" instead of it's location, we can restore the checkbox for this case.

This means that checking the checkbox will no longer mean (in this case) "Do not show this again for apps from the publisher and location above", but instead will mean: 
"Do not show this again for this app from the publisher above.", and we should change the text show accordingly.

If the dialog is accepted with the checkbox checked we will not show the dialog again for the identical jnlp file (same app) when the certificates used to sign the main jar have not changed.

This will not effect a case where the jnlp file actually changes between runs.
Comments
Removing the BPR label as this fix is no longer needed in a BPR - already shipped as part of - rptno=25064286
23-03-2017

fix applies both to signed sandbox and signed all-permissions applications. crucible review: https://java.se.oracle.com/code/cru/CR-JDK9CLIENT-1979 test example (all-permission) : http://oklahoma.us.oracle.com/www/tests/sandbox/helloa-nohref.jnlp test example (sandbox): http://oklahoma.us.oracle.com/www/tests/sandbox/hellos-nohref.jnlp
20-05-2016