Java Security

Extensions to the Class Loader

When we implemented a class loader above, we had a fully operational class loader that paralleled the first class loaders that were used by Java’s appletviewer or by a Java-enabled browser. However, there are other extensions to the class loader that are often useful.

Class Loaders and Other Protocols

Long before HTTP and the Web became popular, IP networks like the Internet had dozens of other protocols upon which a class loader could be based—FTP, NFS, RCP, and others. It’s possible to write a class loader based on any of these protocols, although it’s not as easy as using HTTP. The standard Java URL class will handle all the low-level details of the HTTP protocol for us, whereas we’d have to write the low-level details of the ftp (or whichever) protocol ourselves. We won’t show an example of any of these protocols, since the concepts are all the same.

One advantage these protocols have is that they typically offer some level of user authentication: FTP requires a password, NFS requires appropriate credentials to be sent, etc. Hence, some of these protocols might seem well-suited to an implementation where security is a concern—except that this level of authentication is often no stronger than simply putting the classes to be downloaded on a web server that requires a password to get into a particular directory.

Loading from Multiple Sites

We started with a complete class loader suitable for use in appletviewer-type programs where the classes are ...