Security Error

[Rob Wright]

I have an applicatioin that I have built. When the application was first built it was constructed to run without webstart. Now I am trying to get it to launch using webstart. I continue to get the following error despite a very exhaustive effort to remove any java.io:

Unsigned application requesting unrestricted access to the system.

I have the console up and the exception only shows me sun code in the stack. This does me no good and for the life of me I cannot figure out where my application is requesting unrestricted access. I do not want to sign my application and want it to run in the sandbox. here is my jnlp file:

<?xml version="1.0" encoding="UTF-8"?>
<jnlp spec="1.0+"
codebase="file:///c:/Documents and Settings/Rob/workspace/passwordjunkie/pub">
<information>
<title>Junkie</title>
<shortcut>
<desktop/>
<menu submenu="SGS"/>
</shortcut>
<vendor>SGS</vendor>
<description>A Manager Program.</description>
</information>
<offline-allowed/>
<security>
<!-- all-permissions/ -->
<j2ee-application-client-permissions/>
</security>
<resources>
<j2se version="1.4+" />
<jar href="junkie.jar"/>
<property name="javaws.debug.0" value="+TraceSecurity"/>
<property name="javaws.debug.1" value="+TraceCache"/>
<property name="javaws.debug.2" value="+TraceDiskCache"/>
<property name="javaws.debug.3" value="+TraceDownload"/>
<property name="javaws.debug.4" value="+TraceXMLParsing"/>
</resources>
<application-desc main-class="com.sgs.junkie.gui.Junkie"/>
</jnlp>

Is there some way to figure out where my code is trying to request full access to the system.

[Rob Wright]

By the way this is the jnlp file I am attempting to use for development so i can compile and run local without putting the jar file up on the server. Coult this be the source of my problem?

[Ed Ewing]

The problem might be this line

<j2ee-application-client-permissions/>

Or the problem may be that you are trying to access certain System properties. The documentation here might be useful:

http://lopica.sourceforge.net/ref.html#security

[Clarke Kent]

I think you should sign your application since you are accessing resources of the client machine.