Question

Basically, I have a self-signed (for now) Java applet that prints stuff. Even though I can print without signing the applet, I do not want to prompt the user every time they get to my website. The worst part is that they get a prompt for each and every operation you do on a PrinterJob object. Now, if they accept the certificate, the do not get any printing prompt, which is exactly the behavior I want. Unfortunately, if they refuse the certificate, they have to accept the printing prompts again. What I want to do, is stop the applet if they refuse the certificate. To do that, I have tried the following:

public void init(){ 
    doPrivileged(new PrivilegedAction<Void>() {
        @Override
        public Void run() {
            _appsm = System.getSecurityManager();
            if (!hasPrintPermissions()) return null;

            printer = new MarketplaceLabelPrinter();
            LOG.info("Initialized");
            return null;
        }
    });
}

/**
 *  Returns true if the applet has enough permissions to print
 */
public boolean hasPrintPermissions(){
    try{
        _appsm.checkPrintJobAccess();
    } catch (SecurityException e) {
        LOG.severe("Not enough priviledges to print.");
        return false;
    }
    return true;
}

This does somewhat work, but it prompts the user, which I do not want. The worse part is that this security check is completely useless, because if they press OK but do not check “always allow this applet to access the printer”, the security check thinks it has access to the printer, but in reality it does not. (See: https://i.stack.imgur.com/ZkwFe.png)

In summary, I want the applet to stop running if the user refuses the certificate.

Thanks everyone

Answer 1

Do a try/catch on something that would not be permitted in an untrusted applet. Pseudocode e.g.

public static boolean isTrusted() {
  boolean trusted = false;
  try {
    SecurityManager sm = System.getSecurityManager();
    // not permitted in a sand-boxed app.
    System.setSecurityManager(null);
    // restore the trusted security manager.
    System.setSecurityManager(sm);
    // This code must be trusted, to reach here.
    trusted = true;
  catch(Throwable ignore) {}
  return trusted;
}