Newsletter sign-up
View all newsletters

Enterprise Java Newsletter
Stay up to date on the latest tutorials and Java community news posted on JavaWorld

Sponsored Links

Optimize with a SATA RAID Storage Solution
Range of capacities as low as $1250 per TB. Ideal if you currently rely on servers/disks/JBODs

JavaWorld.com > Java Standard Edition >

Java security: How to install the security manager and customize your security policy

Learn about the security manager and the Java API, what remains unprotected by the security manager, and security beyond the JVM architecture

By Bill Venners, JavaWorld.com, 11/01/97

  • Print
  • Feedback

Page 2 of 7

Areas unprotected by the security manager

Two actions not present in the above list that could potentially be unsafe are allocation of memory and invocation of threads. Currently, a hostile applet can crash a user's browser by:

  • Allocating memory until it runs out
  • Firing off threads until everything slows to a crawl


These kinds of attacks are called denial of service attacks, because they deny users the ability to use their own computers. The security manager does not allow you to enforce any kind of limit on allocated memory or thread creation. (There are no checkAllocateMemory() or checkCreateThread() methods in the security manager class.) The following are other kinds of hostile applets that currently are possible:

  • Applets that send unauthorized e-mail from the user's computer
  • Applets that make annoying noises even after you leave the Web page
  • Applets that display offensive images or animations


So, a security manager isn't enough to prevent every possible action that could offend or inconvenience a user. Other than the attacks listed here, however, the security manager attempts to provide a check method that allows you to control access to any potentially unsafe action.

  • Print
  • Feedback

Resources