FindClass() sometimes
fail when called from native code?Java Web Start provides a platform-independent, secure, and
robust deployment technology. It enables developers to deploy
full-featured applications to end-users by making the
applications available on a standard web server. With any web
browser, end-users can launch the applications and be confident
they always have the most-recent version.
Back to top
Where do I get more information?
Look at the online documentation for Java Web Start.
If you are a developer, go to the Developer's
Guide for detailed technical information on how to deploy
applications using Java Web Start.
Back to top
Why should I use Java Web Start?
It's an easy, robust, and secure way to deploy applications directly from the web. Developers can make applications readily available via the web. In addition, Java Web Start provides Java runtime environment (JRE) management capabilities, it's easy to set up, it's browser-independent, and it's an efficient way to deploy web application solutions.
Users can easily access applications much as they would a web page — without a separate installation step. From the desktop, users can access and use Java applications, using a richer and more responsive user interface than is available on a web page. And, once a Java Web Start based application is installed, users simply click to run the application whenever needed.
Users do not need to manually update applications because each
time they launch an application, it is transparently updated from
the web — so they always use the most recent version
available.
Back to top
How can I launch applications with Java Web Start?
You initially launch a new application by clicking on a link from a web page.
If you use an application frequently, create a shortcut from
your desktop or from the Start Menu by allowing Java Web Start to
place an icon on your desktop. Java Web Start may ask if you
would like to create
shortcuts or an entry in the Start Menu. If you say "yes," all
future launches of the application can start without a
browser.
Java Web Start also provides an Application Cache Viewer which you can launch from the Java Control Panel.?? The Cache Viewer enables you to directly launch applications you have downloaded.
You can also launch an application from a command prompt by
typing javaws jnlp_url where
jnlp_url is a URL to the JNLP file of the
application.
Back to top
Does it matter how I launch an application?
No, applications launch in the same manner no matter which method you use: from a web page, from the shortcut on the desktop, from the Start menu, or through the Java Application Cache Viewer.
Java Web Start always checks to see if a newer version of the application is available for use and automatically downloads it if so.
If the application you are using has not been digitally
signed, Java Web Start will launch it in a restricted and secure
execution environment. An application that is not signed, or one
that you do not trust, will never be run with unrestricted access
to your local system or network.
Back to top
What are the system requirements for Java Web Start?
Any client system that supports Java SE 8 can use Java Web
Start. See
Oracle JDK 8 and JRE 8 Certified System Configurations.
Back to top
What platforms does Java Web Start run on?
See
Oracle JDK 8 and JRE 8 Certified System Configurations.
Back to top
What are the server requirements for Java Web Start?
Java Web Start uses HTTP for communication between the client
and the server. You can use a standard web server to host an
application. If you require additional services, such as
version-based downloading, incremental updates, or pack200
compression for your applications, the web server will need to
support servlets or Java Server Pages. A sample servlet
implementing these features is provided in the samples directory
of the JDK.
Back to top
Is Java Web Start based on a standard?
Yes. Java Web Start is the product-quality reference implementation of Java Network Launching Protocol (JNLP) technology, which was developed through the Java Community Process.?? JNLP is specification number JSR 56.?? Other platform vendors are encouraged to port Java Web Start to their platform or implement the specification.
For more information, see JSR 56: Java Network
Launching Protocol and API.??
Back to top
Can I implement my own Java Web Start?
The underlying technology for Java Web Start, the Java Network
Launching Protocol and API is being developed through the Java
Community Process, so you can implement this protocol in any
product. However additional licensing and terms must be met to
implement any JCP technology including the JNLP technology.
Back to top
What are the supported browsers?
See
Oracle JDK 8 and JRE 8 Certified System Configurations.
However any browser can launch JNLP files if you have set the
MIME-type association correctly. Java Web Start uses the
browser's settings and may launch a browser to show a URL; this
feature may not work with unsupported browsers.
Back to top
Is there a comprehensive list of online resources for Java Web Start?
Can I deploy any application with Java Web Start?
Java Web Start is an application launcher for Java applications that are written to be web-deployed.
An application must be delivered in a set of JAR files and all application resources, such as images, configuration files, and native libraries must be included in the JAR files. The resources must be looked up using the method ClassLoader.getResource() or an equivalent method. Java Web Start only transfers JAR files from the web server to the client.
If an application is written to run in a restricted execution
environment (sandbox), then access to disk is not permitted and
the application may only connect to the host on which it
resides.
Back to top
Is Java Web Start a software distribution mechanism like Marimba and MS SMS?
Java Web Start is an application launcher for Java applications. It allows easy distribution of full-featured applications based on the Java platform from a web server to a client machine with minimal user interaction.
The software distribution technology is only one aspect of
Java Web Start. It also provides security, updates to the
applications, ease-of-use for end users, and flexibility for
developers when they create the applications.
Back to top
Is Java Web Start an application installer?
Java Web Start is an application launcher for Java
applications that are written to be web-deployed. Java Web Start
caches resources locally on the disk, but also provides a secure
execution environment and a virtually transparent updating
facility for applications. The end user does not need to manually
initiate a software update because the application is updated
each time it is used.
Back to top
What version of the Java platform does Java Web Start work with?
Java Web Start launches only applications written for the Java
platform versions 1.2.2 and higher.
Back to top
How does Java Web Start relate to Java Plug-in Technology (applets)?
The two approaches are very similar. The key difference is in the user experience. If the Java application/applet needs to interact with a web page and be tightly bound to a web browser, then applets may be the solution. On the other hand, if browser independence is important, then Java Web Start is the deployment platform of choice. There are a number of other differences, but this is the fundamental difference.
Java Plug-in technology enables users to run Java applets inside a browser.
Java Web Start enables users to download full-featured
applications with any browser. Once they have downloaded and
launched an application, the browser can be closed, while the
application continues working. The application does not depend on
an open browser to function. The browser can be shut down or you
can go to a different web page and the application will continue
running.
Back to top
Do I need to change my application to work with Java Web Start?
If your application is written for Java SE, and is delivered as a set of JAR files, there should be no need to revise your application.?? Make sure that your application retrieves all its resources (such as images and resource bundles) from a JAR file, since Java Web Start launches an application by invoking the public static void main(String[] args) method.
If your application needs unrestricted access to the system,
(for example, network or disk access), you will need to sign your
code.
Back to top
Is there a migration path from applets to applications???
Java Web Start is primarily designed for application
deployment. You specify all requirements for your application in
the JNLP file, and off you go. It does provide the ability to
launch applets in much the same way as the traditional
AppletViewer. The built-in AppletViewer provides an easy
migration path for existing applets that want to take advantage
of Java Web Start. However, it is not intended to be a full
implementation of the Plug-In. The Plug-In is the primary
launching vehicle for applets. The built-in AppletViewer in Java
Web Start has?? limitations, for example, you cannot specify class
files as resources and it does not accept policy files.
Back to top
Is there a way to pass VM arguments to the Java Runtime?
Java Web Start allows certain JVM flags to be set with the
java-vm-args attribute of the j2se element
(see Developer's
Guide). Allowing the complete set could compromise security
as well as limit portability across different platforms and
implementations. You can set the maximum and initial heap size
using the initial-heap-size and max-heap-size attributes of the
j2se element, for example:
<j2se version="..." max-heap-size="100M"/>
I don't want to rely on a server timestamp. How can I specify a versioned JAR and how can I get incremental updates of JARs?
Java Web Start supports versioned JARs and incremental
updates. You can specify exact versions of the JAR files you
want, instead of relying on timestamp information to determine if
an update is available. Using version IDs also allows you to
provide incremental updates from one version to another. See the
JNLP
Specification or the Developer's
Guide for details.
Back to top
Are JAR files shared between applications?
Each JAR file that a JNLP Client (such as Java Web Start)
downloads, is uniquely identified with a URL. If two JNLP files
use the same URL, then the resource will only be downloaded once
and shared. This is similar to the caching implementations used
by web browsers.
Back to top
How can I provide my own splash screen?
Java Web Start needs to put up the initial splash screen while Java is loading. For subsequent access, you can specify an image file to use for the splash screen in the JNLP file with the tag
<icon href="mysplash.jpg" kind="splash"/>
where mysplash.jpg is the image file for your
splash screen.?? The first time your application runs, it will use
the standard splash screen. After that, it will use the image you
provide.
Back to top
How can I save the application state on the local system?
A sandboxed application can store state using the PersistenceService API. This API is similar to cookies for HTML pages. Thus, it is a secure way to store persistent information on the client computer.?? For more information, see:
My application requires a specific version of the JRE. How do I specify this my JNLP file?
The tag <j2se version="versionNum"> specifies a platform version, where versionNum is 1.2, 1.3, 1.4, 1.5, 1.6, 1.7, and 1.8.
You can request a specific product version by including a
vendor URL in the href attribute. For Oracle's JREs, the URL is
http://javadl.sun.com/webapps/jawsautodl/AutoDL/j2se
For example, the following J2SE tag will request any Sun 1.3.1
implementation:
<j2se version="1.3.1*" href="http://javadl.sun.com/webapps/jawsautodl/AutoDL/j2se"/>
You can see all the versions of the installed JREs in the Java
tab of the Java Control Panel.
Back to top
Can I rely on Class-Path in the manifest file?
Java Web Start does not support the Class-Path entry in the manifest file. The Class-Path attribute is entirely file-centric, whereas Java Web Start and JNLP is web-centric, i.e., based on URLs. Thus, the two models do not merge easily.
Instead of relying on the Class-Path entry, you can list multiple JAR files in the JNLP file, for example:
<resources> <jar href="A.jar"/> <jar href="B.jar"/> </resources>
In a JNLP file, you can factor out dependencies on a set of JAR files to another JNLP file using the <extension... > element. Thus, you can achieve the same kind of re-usability and ease of maintenance as you do with the Class-Path entry. This feature is described in the specification.
JNLP also implements a just-in-time downloading mechanism, similar to applets. For each resource in a JNLP file, you can specify which parts should be eagerly or lazily downloaded.?? Eagerly loaded resources are loaded before the application is launched, lazily loaded resources later.?? Default is eager download. Furthermore, the specification includes an API for which you can programmatically query Java Web Start about which resources are available and request them to be downloaded. Thus, you can write download/network aware applications.
See the JNLP
specification for more information.
Back to top
Can I use Java Web Start even if my application depends on or uses native code?
You can use Java Web Start to deploy Java Technology-based
applications that depend on native code such as DLLs and SOs. Use
the <nativelib ...> element to specify required
native libraries. See the Developer's
Guide for details.
Back to top
How can I load resources within my application using Class.forName and ClassLoader.getSystemClassLoader?
Java Web Start uses a user-level classloader to load all the application resources specified in the JNLP file. This classloader implements the security model and the downloading model defined by the JNLP specification. This is no different than how the AppletViewer or the Java Plug-In works.
This has the, unfortunate, side-effect that Class.forName will not find any resources that are defined in the JNLP file. The same is true for looking up resources and classes using the system class loader (ClassLoader.getSystemClassLoader).
To find application resources in Java Web Start, use the classloader that loaded your application, for example use the following call in the in the application's main thread:
this.getClass().getClassLoader();
You can also use:
Thread.getCurrent().getContextClassLoader();
Back to top
How can I launch Java Web Start from the command line?
You can launch Java Web Start from the command line as follows:
javaws [options] your-app-JNLP-URL
where your-app-JNLP-URL is the location of your application's JNLP file.?? For example, the following command starts the Dynamic Tree Demo application (from the Java Tutorials):
javaws https://docs.oracle.com/javase/tutorialJWS/samples/deployment/dynamictree_webstartJWSProject/dynamictree_webstart.jnlp
For complete command line syntax see: the Developer's
Guide
Back to top
How do I use multiple JAR files signed by different certificates?
The JNLP 1.0 specification requires all JAR files used in a JNLP file to be signed by the same certificate. This restriction avoids requiring the user to accept multiple certificates from the same source, and enables Java Web Start to know if the user has accepted all certificates used for an application.
However, Java Web Start can use multiple JAR files signed by different certificates, by using the component extension mechanism and multiple JNLP files.?? The only requirement is that the JAR files contain code from different packages.?? So, instead of the following:
<jar href="myjar1.jar"/> <jar href="jh.jar"/>
Use the following:
<jar href="myjar1.jar"/> <extension name="Java Help" href="help.jnlp"/>
Then add a help.jnlp file with the following contents:
<?xml version="1.0" encoding="utf-8"?> <jnlp spec="1.0+" codebase="http://ws503" href="Help.jnlp"> <information> <title>JavaHelp</title> <vendor>Sun Microsystems, Inc.</vendor> </information> <resources> <jar href="jh.jar"/> </resources> <component-desc/> </jnlp>
How do I detect if Java Web Start is installed?
You can write a short JavaScript or VBScript to detect if Java
Web Start is installed. See the Developer's
Guide for details.
Back to top
Why does my browser shows JNLP file as plain text ?
This is most likely happening because your web server is not aware of the proper MIME type for JNLP files. Java Web Start requires only one change to your web server, that is creating an association between the file extension, typically jnlp, and the MIME type, application/x-java-jnlp-file. The steps for doing this vary depending upon the web server you are using.
Furthermore, if your corporation uses a proxy server, ensure
that the update versions of the files are returned, by updating
the time stamp of the resources on the web server such that the
proxies will update their caches.
Back to top
Why does Java Web Start always reload JAR files from IIS server?
If a timestamp of the file on the IIS server is in the future
IIS returns current-time as last-modified time. This makes Java
Web Start to reload the JARs since time-stamp is always
newer.
Back to top
Can I use Pack200 compression with the JnlpDownloadServlet?
Yes. The JnlpDownloadServlet distributed in the samples
directory of the JDK now supports pack200. If you
deploy yourfile.jar along with
yourfile.jar.pack.gz the packed file will be
downloaded when the client is running Java Web
Start.
Back to top
What is the best way to ensure only one instance of my application is run?
Use the SingleInstanceService to register as a singleton as soon as your application starts up. Re-invoking your application before it is registered as a singleton will cause another Java VM to start up.
Make sure to unregister before your program
exits.
Back to top
When will properties set in the JNLP file get set?
Normally, properties in the JNLP file will not be set until
the first resource listed in that JNLP file is loaded. This
insures the properties are set before any of your code is run,
however some properties need to be set before other packages are
loaded. Some properties are considered to be “secure”
by Java Web Start, and, when found in the main JNLP file, will be
passed as arguments to the invoking VM
(-Dname=value).
The list of “secure” properties for this version
can be found in the Developer's Guide.
Back to top
What causes the file not found message for the downloaded JNLP file?
You click on a JNLP file, and Internet Explorer downloads the file, then launches Java Web Start, but you get the message: “Could not load file/URL specified: C:\Documents and Settings\...\application[1].jnlp”.
This problem is specific to Internet Explorer. Although this
can be caused by a full cache, or turning off the cache in IE, it
is usually caused by a no-cache directive coming from either the
web server or the proxy server. IE will honor this directive, and
not write the JNLP file to disk, so Java Web Start cannot find
it. This frequently happens when upgrading a Tomcat based server.
Later versions set the no-cache directive by default for any
resource that is within a security-constraint in web.xml. Try
taking the relevant URI out of the security constraint in
web.xml.
Back to top
How can I use signed JAR files (such as JCE extensions) signed for other purposes?
You can multiply sign the jar, adding code signing
certificates over another existing certificate chain. With
previous versions, you would either have to run the jar as a
component extension w/o all-permissions, or strip the existing
certificates before adding code signing certificates. (which in
many cases rendered the package inoperable.)
Back to top
Why can't I use the Association feature on some Linux platforms with Gnome?
The association feature specifically requires
libgnomevsf-2.so. If this library is not present, associations
are not supported.
Back to top
How do I set up my server to broadcast the JNLP MIME type?
Each web server has a specific way in which to add MIME types. For example, for the Apache web server you must add the following line to the .mime.types configuration file:
application/x-java-jnlp-file JNLP
Check the documentation for the specifics of your web server.
Back to top
How do I set up my server to use the JnlpDownloadServlet?
See the Developers
Guide section on using the servlet. The application need not
be packaged in a Web Archive.
Back to
top
How are Applications uniquely identified?
An application is normally identified by the value its
href attribute (the URL to its JNLP file.) If there
is no href value to the JNLP file, then it is
identified by the href value to its main JAR file.
If multiple applications share the same main JAR file, they must
contain an href value, or they will be treated as
the same application.
The Java Application Cache Viewer, will show all applications,
even those without an href value. The Viewer can
only launch an application online, if it has an href
value. Without an href value, it can launch offline
if the JNLP file allows (contains the
<offline-allowed> element)
In previous versions, the Application Manager will only show those applications with an href.
The same thing applies to creating shortcuts. You can only
create a shortcut to launch online if there is an
href value, and can only create an offline shortcut
if <offline-allowed> element is
specified.
Back to top
How do I create multiple file-extension/mime-type associations with a JNLP application?
When creating multiple file-extension/mime-type associations with your JNLP application, it's recommended that you use multiple association tags. Also, both the file-extension and mime-type must be specified for each association tag. For example:
<association extensions="aaa" mime-type="x-application/aaa"/>
<association extensions="bbb" mime-type="x-application/bbb"/>
Back to top
Why does
FindClass() sometimes fail when called from native
code?
When JNI code that may be called on the EventDispatch Thread
calls FindClass() then it may fail. For more
information, see the FindClass
function.
Security is a key consideration of the Java Web Start design.??
In Java Web Start all applications are launched by default in a
secure "sandbox."
Back to top
Applications in the secure sandbox have restricted access to
local computing resources such as the disk and network.
Back to top
How is the Java Web Start secure sandbox more flexible than the applet sandbox?
All applications, by default, are run in a sandboxed environment, similar to the applet sandbox. However, Java Web Start provides a secure API that enables an application to import and export files from the local disk under the user's control. The API includes dialog boxes for operations such as saving a file and opening a file that are actually rendered by Java Web Start, and not by the application itself.
This sandbox design is similar to what you can do with HTML. A
file input field in an HTML form enables a user to pick a file
from the local disk and submit the name (excluding path) and
content?? to the web server. Similarly, most browsers support the
'Save as...' option.
Back to top
How can I enable my application to gain unrestricted access to the system?
An application requesting unrestricted system access must be
digitally signed. The first time a user launches such an
application, a security dialog box will appear. Before running
the application, Java Web Start will prompt the user to accept
the digital certificate. After the user has accepted the
certificate, subsequent invocations will not show the security
dialog box.
Back to top
Is there support for encrypted download of JAR files?
Support for encrypting data transferred from the server to the client is very important. This is an important point on our issue list, and we will definitely make sure that HTTPS libraries will work with applications that are launched with Java Web Start. The HTTPS support might be in an optional package that you need to specify that your application depends on.
Encrypting the JAR files transferred from the server to the client may not be necessary. The reason is, even if the class files where encrypted on the wire, they will have to be decrypted on the client side and stored to disk, so the JVM will be able to load the classes. Thus, it could be fairly simple for a cracker to get around the encryption of the JAR files.
Instead, what is important for JAR files is that they can be
signed, so the user can be absolutely sure that the application
is from the vendor he expect it to be from. This is already
supported.
Back to top
Can I use NTLM authentication with Java Web Start?
Yes, you can use Windows NT LAN Manager (NTLM) authentication
with Java Web Start.
Back to top
Can I use HTTPS protocol with Java Web Start?
Yes.
Back to top
Are there other online resources to learn more about the security tools?
See the following:
