Java applets security considerations

First of all, What are you doing here? Applets are absolutely deprecated and they will disappear definitely with Java 9.
Having said that, I´m currently working with some applets and java web start components, and very often we found with security issues and warnings coming  from de Java configuration.

The common errors I usually get are:

Your security settings have blocked an application from running due to missing a 'Permissions' manifest attribute in the main jar

Your security settings have blocked an untrusted application from running

The first one is easy to solve. Just add de permissions attribute in the manifest, usually with value "all-permissions".


For the second one you need to sign de applet (jarsigner) and to do one of the following things:
a) Add your site to the trusted sites of Java.
Go to Configure Java > Security > Edit list of sites. Add the one hosting your applet, for example http://localhost:8080.

b) Add the CA of the signer certificate to the trusted Authorities of Java.
Go to Configure Java > Security > Manage Certificates > CA of Signer.


I created two simple java project to play with these problems:

• simple-applet. This is the applet project. In the pom.xml file you can see the plugins to insert de manifest entries and the signer.
• simpe-boot-applet. This is the web app which uses the applet. You need to open http://localhost:8080/applet