applet access control problem - security

Question

i have applet which in turn is connecting to server for filewriting .When i tried to connect to the server using localhost :
it works on my machine (server is on the same machine ), but doesnot work on other machine .
when i try with IP address it works no where
my applet code :
public class dynamicTreeApplet extends JPrefuseApplet {
private static final long serialVersionUID = 1L;
public static int i = 1;
public String dieasenameencode;
public void init() {
System.out.println("the value of i is " + i);
URL url = null;
//Here dieasesname is important to make the page refresh happen
//String dencode = dieasenameencode.trim();
try {
//String dieasename = URLEncoder.encode(dencode, "UTF-8");
// i want this piece of the code to be called
url = new URL("http://localhost:8080/docRuleTool/appletRefreshAction.do?dieasename=");
URLConnection con = url.openConnection();
con.setDoOutput(true);
con.setDoInput(true);
con.setUseCaches(false);
InputStream ois = con.getInputStream();
this.setContentPane(dynamicView.demo(ois, "name"));
ois.close();
} catch (MalformedURLException e) {
e.printStackTrace();
} catch (FileNotFoundException f) {
f.printStackTrace();
} catch (IOException io) {
io.printStackTrace();
}
++i;
}
}
java policy file :
grant {
permission java.net.SocketPermission "*", "accept";
permission java.net.SocketPermission "*", "connect";
};
my jar are not signed and i donot want them to be signed as well from maintaince perspective .

Answer 1

it works on my machine (server is on the same machine ), but doesnot work on other machine
Yes but it really only makes sense for the applet being served from 'the other machine' to be writing back to 'the other machine. The code above has..
url = new URL("http://localhost:8080/docRuleTool/appletRefreshAction.do?dieasename=");
Which means the applet coming from the other host is attempting to write the data back to a 'localhost' that probably does not exist. Instead, your applet should form the URL using something more along the lines of..
url = new URL(getDocumentBase(), "/docRuleTool/appletRefreshAction.do?dieasename=");
If the code does that, it should be able to remain sand-boxed.
And as an aside, policy files are really only of use for development purposes. If the code needs trust for real world deployment, it needs to be digitally signed.