Java applet manifest - Allow all Caller-Allowable-Codebase

Question

As of Java 7u45 an applet will display a warning message (even if signed with a trusted cert) if a webpage tries to interact with it via javascript and that page isn\'t list

Answer 1

This set of attributes allows the applet to load without warnings in Java 7u45:

Application-Name: ...
Main-Class: com...
Sealed: true
Codebase: *
Caller-Allowable-Codebase: *
Permissions: all-permissions

We have tested on the following JVMs:

• Java 6u20 (OK, well duh!)
• Java 7u21 - must include Trusted-Library to avoid warning
• Java 7u25 - must include Trusted-Library to avoid warning
• Java 7u40 - must include Trusted-Library to avoid warning
• Java 7u45

So the long and short is we have a dilemma; to have no warning on 7u21, 7u25 and 7u40 you must include Trusted-Library:true, and to have no warning on 7u45 you must omit this property.

Thanks Oracle for a Kobayashi Maru - we love you.