Spec-Zone .ru
спецификации, руководства, описания, API
|
|
Spec-Zone .ru
спецификации, руководства, описания, API
|
Note: This Java deployment guide describes features released prior to the Java SE 6 update 10 release. See Java Rich Internet Applications Development and Deployment document for the latest information.
When running an applet in a browser using the Sun Java Runtime Environment (JRE), if the applet makes HTTP requests to a server that redirects the request to an HTTPS URL, the redirection fails. The redirection also fails in the case of making HTTPS requests to a server that redirects the request to an HTTP URL. The same applet runs without any error in the Microsoft Virtual Machine (VM).
The issue is caused by the HTTP or HTTPS redirection policy implemented in Sun JRE. Because of serious security consequences, redirection between HTTP and HTTPS is not automatically followed.
When an applet is run in a browser using the Microsoft VM, a security warning dialog prompts the user for his consent to redirect. Redirection fails if the user does not consent to it.
The application which runs the applet in a browser needs to check the response code and recognize it as a redirect. The Location header field value can be checked for the redirect information, and then the application must decide whether or not to follow the redirect using the new protocol. For example, if the following code is available in an application:
public void makeConnection(URL url)
{
URLConnection conn = url.openConnection();
InputStream is = conn.getInputStream();
....
is.close();
}
the above code should be changed to the following code:
private InputStream
openConnectionCheckRedirects(URLConnection c) throws
IOException
{
boolean redir;
int redirects = 0;
InputStream in = null; do
{
if (c instanceof
HttpURLConnection)
{
((HttpURLConnection)
c).setInstanceFollowRedirects(false);
} // We want to open the
input stream before getting headers
// because getHeaderField() et
al swallow IOExceptions.
in = c.getInputStream();
redir = false;
if (c instanceof
HttpURLConnection)
{
HttpURLConnection
http = (HttpURLConnection) c;
int stat =
http.getResponseCode();
if (stat
>= 300 && stat <= 307 && stat != 306
&&
stat
!= HttpURLConnection.HTTP_NOT_MODIFIED)
{
URL
base = http.getURL();
String
loc = http.getHeaderField("Location");
URL
target = null;
if
(loc != null)
{
target
= new URL(base, loc);
}
http.disconnect();
// Redirection should be allowed only for
HTTP and HTTPS
//
and should be limited to 5 redirections at most.
if
(target == null || !(target.getProtocol().equals("http")
||
target.getProtocol().equals("https"))
||
redirects >= 5)
{
throw
new SecurityException("illegal URL redirect");
}
redir
= true;
c
= target.openConnection();
redirects++;
}
}
}
while (redir);
return in;
}
public void makeConnection(URL url){
try{
URLConnection conn = url.openConnection();
InputStream is =
openConnectionCheckRedirects(conn);
....
is.close();
}catch (IOException e){ } }
None.
