我正在尝试通过小程序通过 js 调用访问智能卡密钥库。
我正在寻找最佳实践，并希望有一个指导，注意安全问题。
我可以在其中做什么和不能做什么？
仅仅使用 doPrevileged 就足够了吗？
小程序在这些方面有哪些限制？
应该使用 JApplet 还是 Applet？
我确实需要一些指导。
我只有一个请求：我不想使用外部库。
谢谢
补充：
看起来，sun 文档解释说：
签名小程序
签名的小程序没有施加的安全限制
在未签名的小程序上，可以在安全沙箱之外运行。
注意：
JavaScript 代码被视为未签名代码。
小程序是通过 HTML 页面中的 JavaScript 代码访问的，小程序是
在安全沙箱内执行。这意味着签署的
小程序本质上的行为就像未签名的小程序。
但我遇到过其他小程序，尽管它们的方法是在 js 中调用的，但使用 JDialog 以便用户启动操作。
I am attempting to access the smartcard keystore, by an applet, through a js call.
I am searching for best pratices, and hopefully a guide, minding the security issues.
What I can and cannot do in it?
Just the use of doPrevileged is enough?
What are the limitations that an applet has in those matters?
Should use a JApplet or an Applet?
I really do need some directions.
I just have one request: I don't want to make use of outside libraries.
Thanks
Addendum:
as It seems, the sun documentation explains that:
Signed Applets
Signed applets do not have the security restrictions that are imposed
on unsigned applets and can run outside the security sandbox.
Note:
JavaScript code is treated like unsigned code. When a signed
applet is accessed from JavaScript code in an HTML page, the applet is
executed within the security sandbox. This implies that the signed
applet essentially behaves likes an unsigned applet.
But I have come to other applets that, although their methods are called in js, use JDialog so the user starts the action.
发布评论
评论（1）
智能卡是一个宽泛的术语，即使使用所谓的加密卡（区别是智能卡可以托管应用程序，而加密卡仅提供固定的加密功能集）也可以。这里有一个关于此主题的新系列（虽然看起来只有两部分）：http://rostislav-matl.blogspot.com/2011/09/using-smart-card-as-keystore-in-java.html 。
您可能会发现找到不太昂贵且多平台的解决方案并不容易。
Smartcard is a wide term, you will be fine even with so called cryptocard (the difference is smartcard can host applications while cryptocard provides only fixed set of cryptography functions). There is a new serie (looks it will have only two part though) about this topic here: http://rostislav-matl.blogspot.com/2011/09/using-smart-card-as-keystore-in-java.html .
You'll probably find that finding not too expensive and multiplatform solution is not easy.