Today i ll gloss over a few small things worth remembering about security
in java . So lets get started :
In Java , we hava a Java API . The java API provides us with a lot methods to accomplish different type of tasks . Now if for some reason we want to enforce security on these tasks so that only selected operation can be performed and that to by selected users . In that case we need to create a
security policy file.
In the security policy file , we specifiy how permissions are applied to different code sources . We specify differnt permissions in terms of
Permission objects that are applied to
CodeSource objects .
At runtime a policy object is created corresponding to the policy file .
For the policies to take effect a
SecurityManager needs to be installed . Once the security manager is installed it uses the
AccessController ,which inturn checks the different permissions based on different permission objects .
When the class loader loads a type in the JVM . It places the type in a protection domain , which encapsulates the permissions . At runtime , when methods on the type instance are invoked the security manger is checked to see if the method can be invoked .