Home/ Questions/Q 341449
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-12T10:42:36+00:00

Is it sufficient to secure a Java web application with the rights of the

  • 0

Is it sufficient to secure a Java web application with the rights of the user that is running the application server process or is it reasonable also to use SecurityManager with a suitable policy file?

I have used to do the former and not the latter, but some customers would like us to also use SecurityManager that would explicitly give permissions to every third-party component to be sure there isn’t any evil code lurking there.

I’ve seen some Servlet containers, like Resin to propose not using SecurityManager to slow things up. Any thoughts?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    While I hate to ever recommend not using a security feature, it’s my opinion that a SecurityManager is more intended to manage situations where untrusted or third-party code is executing in the JVM. Think applets, or a hosted, shared app server scenario. If you have complete control over the app server and are not running anybody else’s code, I think it’s redundant. Enable the SecurityManager does have significant performance impact in my experience.

    • 0