Java Applet with form based authentication works o

Question

The setup is as follows: Web Application (EAR file) packaging a Java Applet component and using form based authentication is deployed to WebSphere 8. Workstation is using Java 1.7.0_45.

When connecting from IE11 after authenticating the login form, WebSphere returns an Html page containing an Applet tag. The Applet Jar file is then downloaded correctly from WebSphere and the Applet is launched.

When using Chrome however the download of the Applet Jar file fails as if the authentication token was lost.

Here is an excerpt from the Java Plugin trace file:

IE11 (good)

network: Connecting http://myserver:9088/MOBILE/jam.jar with proxy=DIRECT
network: Connecting http://myserver:9088/ with proxy=DIRECT
network: Connecting http://myserver:9088/MOBILE/jam.jar with cookie "LtpaToken2=..."
network: Downloading resource: http://myserver:9088/MOBILE/jam.jar
    Content-Length: 632,160
    Content-Encoding: null

Chrome (bad)

    network: Connecting http://myserver:9088/MOBILE/jam.jar with proxy=DIRECT
    network: Connecting http://myserver:9088/ with proxy=DIRECT
    network: Server http://myserver:9088/MOBILE/jam.jar requesting to set-cookie with "WASReqURL=http://myserver:9088/MOBILE/jam.jar; Path=/; HttpOnly"
    network: Cache entry not found [url: http://myserver:9088/MOBILE/adminLogin.html, version: null]
    network: Connecting http://myserver:9088/MOBILE/adminLogin.html with proxy=DIRECT
    network: Connecting http://myserver:9088/ with proxy=DIRECT
    network: Downloading resource: http://myserver:9088/MOBILE/adminLogin.html
        Content-Length: 1,187
        Content-Encoding: null
    java.io.IOException: Invalid jar file
        at com.sun.deploy.net.HttpDownloadHelper.download(Unknown Source)

Note how IE11 sends the LtpaToken2 token cookie while Chrome displays the "requesting to set-cookie with" message.

Any suggestions are welcomed.

Answer 1

Actually it is the other way around ;-)

IE (bad)
Chrome (good)

Since websphere has the HttpOnly flag activated by default (use google translate, didn't find the english one) chrome behaves correctly. IE just ignores that flag and still sends the cookie and thus violating the spec. If you want to allow that java applet(s) should be allowed to access cookies you must disable the HttpOnly setting in your websphere settings (globally) or in your webapplication (locally).