[ Bloke.com || Linux || JavaScript || Java || Volleyball || Link Me ] Free: [ Guestbook || MessageBot || Plugins || Counter || AusPrices || Advertise ] HotBot AltaVista LookSmart Excite Infoseek Lycos DejaNews

Cameron's Java Tips

Making Applets work Through Firewalls

One of the biggest complaints or questions I used to get at AT&T was: How do I get the applets to work through the firewall?. With the new security scheme in Netscape, all java versions after 2.0 no longer work.

The main reason that an applet will fail to work, is that netscape will not allow an applet to make a connection unless it knows the IP address, and more specifically, that it knows the IP address of the first class matches that of other requested URL's (or classes). The reaons for this is to avoid DNS spoofing attacks.

If there is only one class to be loaded, and there are no other connections, the applet will work regardless of if there is a firewall or not.

If there is a second class to be loaded (or another URL) then the class or URL will only load if Netscape can be sure that the IP addresses match.

There are a number of things you can do from the client and (more importantly) from the server that can be done.

---

Client Side

The first trick is to use the IP address. An IP address is the sequence of number that represent the machine (as opposed to the text name). For example the IP address of www.att.com is 198.152.185.65. So you could access the AT&T page with either http://www.att.com/ or http://198.152.185.65/. If you were inside a firewall, then you will notice that the animation applet in the top right hand corner now works. How do I know the IP addess? I hear you ask. Well there is this program called nslookup. If you don't have one connected to the real internet, then try:

NSlookup

The next trick is to use the appletviewer or HotJava with the security mode set to Unrestricted. The of course has the side affect that the applet being loaded has full access to your filesystem (and to do socket connections to any machine that you can talk to). In a firewall situation, this is not advisable. Because now code not being written by you that did not have access to machines inside your firewall now has access!

The next trick is just to copy the applet and all the associated classes to your machine. This is useful if it is something that you use often (or it's a cool game like Europa!!). This has a slight security risk in that now the applet can do any connection it wants to the server that you put it on.

You could also copy the files into your class path. Probably not a good idea. I have not tested the security implications, but I suspect it opens the door to some bad things (like access to your filesystem).

The final trick is to get a real internet connection :-)

---

Server Side

If it more important for the author to understand how to get an applet to work through a firewall, than the user. That way when it just works, the user will be happy! Happy users come back!

In most cases the easiest way to get your applet to work is to set CODEBASE so that it references the applet from your IP address. For example:

<applet codebase=http://198.152.185.65/classes/ code=Animate width=87 height=68>
<param name=img value=/images/anim-half-att-border.jpg>
<param name=fixedpause value=3000>
<param name=pause value=150>
<param name=onclick value=/audio/boing.au>
</applet>

---

Coding

To write really robust code, you can never assume that a class file is loaded. There are many reasons why this can fail (for example, ever see just one broken image on a page while all the rest are okay, then hit reload and it arrives?). So when you first access a class you should check for an exception. In some cases you can try again, in other cases you just have to tell the user that you are hosed.

I don't believe it is acceptable to have exceptions appear in the java console. (So now instead of malloc errors we have class errors!)

---

Socket Connections

If you write code that makes a socket connection to a server (other than that which the applet came from), you are bound to have trouble in a firewall situation.

None of the chat applets work from inside a firewall (sorry let me correct that, none work from inside a firewall with a split DNS). One way to avoid this is to make connections using URL's. So what this really means is writting CGI programs. It is easy to receive information from a CGI program (since URL has an OutputStream) but sometimes (usually?) you also want to send information. There is no real easy way to do this, but I suggest just open a new URL.

---

Gamelan Example

Gamelan (the coolest of all java sites) has a SiteMap class, that can be used to navigate their site. The currect reference is

<applet codebase="/sitemap" code="SiteMap.class" width=62 height=54>
<param name="site" value="/gamelan.site">
<param name="spew" value="yes">
<param name="target" value="_self"> <!-- workaround for Netscape bug -->
</applet>

Now if they made the simple change to

<applet codebase="http://204.168.26.11/sitemap/" code="SiteMap.class" width=62 height=54>

Then their applet would work inside firewalls as well!

Got Java questions? Maybe my Java Board has the answers?