小程序可以从小程序标签授予权限吗
我需要向自签名小程序授予一些权限。如果用户不编辑他的 .java.policy 文件，这是否可能？我在考虑 applet 标记中的一些内容，因为在 JavaWebStart 中，只需通过向 jnlp 文件添加安全标记即可授予应用程序权限。
另外这里 Java Applet Permissions 它指出 “从 JavaScript 调用的小程序方法没有权限，即使您在策略文件中明确授予它们” 这是设计使然吗...我有点看不出它的合理性！？
I need some permissions to be granted to a self-signed applet. Is this possible without the user editing his .java.policy file? I was thinking something in the applet tag, since in JavaWebStart application permissions can be granted simply by adding a security tag to the jnlp file.
Also here Java Applet Permissions it states
"applet methods called from JavaScript have no permissions, even if you explicitly grant them in a policy file"
is this by design... I kind of don't see the rational for it!?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
按照设计，Applet 是在一个非常受控和隔离的环境中执行的。显然，重点是防止恶意代码在客户端计算机上执行。如果您可以在小程序标签中指定权限设置，那么任何安全性都将变得毫无意义，因为您（开发人员）仍然可以完全控制小程序在客户端浏览器中运行后可以执行的操作。
javascript 限制的基本原理是相同的。您不应该能够通过 JavaScript 利用第三方小程序中的安全漏洞，该小程序应始终保留在其受控的“沙箱”中。
Applets, by design, execute in a very controlled and isolated environment. The point is, obviously, to prevent malicious code from executing on the clients machine. If you could specify in the applet-tag the permission settings, that would make any security totally pointless since you (the developer) would still have full control over what your applet could do once it's running in the clients browser.
The rationale for the javascript limitation is the same. You should not be able to exploit security holes in a third-party applet through javascript, the applet should always remain in it's controlled "sand box".
您可以通过 JNLP 部署小程序。我认为罐子需要签名。此处的信息： http://docs.oracle.com/javase/tutorial/deployment/目录.html
You can deploy an applet via JNLP. I think the jar needs to be signed. Info here: http://docs.oracle.com/javase/tutorial/deployment/TOC.html