Question

I have been developed a jnlp file, and it is working properly when client downloads it from his/her browser. No problem up to here, but client can also access to the jar files that my jnlp is referencing, and eventually download them.

I don’t want my jars to be downloaded by others by writing the path from browser. I just want to make the jnlp is directly accessible from browser.

How can I fix this situation ?

Answer 1

You can use the provided JnlpDownloadServlet as a way to block access. The JnlpDownloadServlet (look for it in the samples provided with the JDK) will handle requests for Jar files and do a diff on them. If you setup your web.xml file like

<servlet>
    <servlet-name>JnlpDownloadServlet</servlet-name>
    <servlet-class>com.sun.javaws.servlet.JnlpDownloadServlet</servlet-class>
 </servlet>
 <servlet-mapping>
    <servlet-name>JnlpDownloadServlet</servlet-name>
    <url-pattern>/app/*</url-pattern>
 </servlet-mapping>

then all requests for the files in /app will go through this servlet. This will prevent users from doing a simple browse to see the available files, but if they know the file name they can still create a get request to fetch it through the servlet.

If that is a problem, then you can also put security on access to this servlet (as you would any other servlet) using the security-constraint settings in the web.xml. If you add that, then the javaws launcher will require the user to provide valid credentials before it will download the files. I used BASIC as the auth-method because I wasn’t sure if the javaws client would honor any others.