applet caching

From: Matthijs Blaas (thijs_blaas_at_hotmail.com)
Date: 03/30/04

  • Next message: William Brogden: "Re: Sun one WS : clean shutdown" 
    Date: Tue, 30 Mar 2004 15:18:36 +0200

    I have a situation in which want to secure data an applet is going to send
    to a script, but I don't know if it will suffice to have the applet being
    called from an SSL domain and having it send back to a script on a SSL
    domain...

    I call my applet from a https website (the applet is also hosted on this SSL
    domain) with parameters; the sessionid. The applet is downloaded locally to
    the users pc, does it's job and sends back a score along with the sessionid
    it received. This sessionid is send back because the receiving script will
    validate the incoming data with it, so that nobody could just send their own
    score (they'd need a valid generated session id).

    But if someone would decompile the locally downloaded applet and have the
    modified applet listnen to the sessionid it receives and have the modified
    applet to send his own score along with the hijacked sessionid back... is
    there a way to overcome this or is it already impossible to have the
    modified local applet listnen for the parameters and send its own (ie the
    applet is called on the ssl site, so that one will be initiated)? I don't
    know how this is handled...

    Thanks in advance!

    -Thijs

  • Next message: William Brogden: "Re: Sun one WS : clean shutdown"

    Relevant Pages

    • Re: applet caching
      ... > I have a situation in which want to secure data an applet is going to send ... > called from an SSL domain and having it send back to a script on a SSL ... > domain) with parameters; the sessionid. ...
      (comp.lang.java.programmer)
    • Re: Applet Security doing HTTP
      ... I'm assuming they mean HTTP basic authentication since nobody can seem to give me any other details. ... Then I have an applet that I wrote that is intended to POST some data to the script. ... The only way this could possibly work is if the JVM picks up security tokens from the browser when it makes its HTTP connection. ...
      (comp.lang.java.security)
    • Re: Canadian census snake oil...
      ... Entrust TruePass is a Java Applet based security product. ... SSL site may or may not be hosted by gov't department ... The Census and Income Tax eFile are not roll your own (unless you consider anything ... So in comes TruePass which will encrypt it for "StatsCan Eyes Only" ...
      (sci.crypt)
    • Re: ICQ
      ... > Is there a way to script something for visitors on your web site know you ... Maybe an applet. ... location when you are online. ...
      (comp.lang.java.help)
    • Re: Applet security restrictions and aliased domains
      ... I created an applet that opened a connection ... to a cgi script. ... aliased domains, such that the aliased domains are each folders under ...
      (comp.lang.java.programmer)