Bug 106556

Summary: Second launch of an applet does not get session cookies, opens new instance of Java Plugin
Product: WebKit Reporter: Jonathan Abourbih <jonathan.abourbih>
Component: JavaAssignee: Nobody <webkit-unassigned>
Status: RESOLVED WONTFIX    
Severity: Normal CC: ahmad.saleem792, andersca, ap, rniwa
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: Mac (Intel)   
OS: OS X 10.7   
Attachments:
Description Flags
Maven project to demonstrate none

Description Jonathan Abourbih 2013-01-10 05:49:40 PST
Launching a new applet runs a new version of the Java plugin, and does not get cookies from WebKit. This only occurs on MacOS 10.7, and is not reproducible on MacOS 10.8. It is also not reproducible in Firefox on 10.7. This occurs with any applet.

Steps to reproduce
~~~~~~~~~~~~~~
Pre-steps: Make sure the Java console is showing, and is set to the highest log level (5).

1. Navigate to a page with an applet. Wait for the applet to load and start running.
2. Note that any "network" debug messages in the console include the session cookie.
3. Navigate away from the page, but note that the Java console remains open. (expected behaviour)
4. Go back to the original page containing the applet. Note that network traffic does not contain the session cookie. Also note that a new Java console opens, while the previous one also stays up.

In 10.8 and in Firefox on 10.7, the Java plugin re-uses the existing Java console, and cookies are retained appropriately. That is the expected behaviour.
Comment 1 Jonathan Abourbih 2013-01-10 06:41:10 PST
Here is the result of a successful launch:

Java Plug-in 10.12.2.08
Using JRE version 1.7.0_12-ea-b08 Java HotSpot(TM) 64-Bit Server VM
User home directory = /Users/jabourbih
----------------------------------------------------
c:   clear console window
f:   finalize objects on finalization queue
g:   garbage collect
h:   display this help message
l:   dump classloader list
m:   print memory usage
o:   trigger logging
q:   hide console
r:   reload policy configuration
s:   dump system and deployment properties
t:   dump thread list
v:   dump thread stack
x:   clear classloader cache
0-5: set trace level to <n>
----------------------------------------------------
cache: Initialize resource manager: com.sun.deploy.cache.ResourceProviderImpl@73844508
security: property package.access value sun.,com.sun.xml.internal.ws.,com.sun.xml.internal.bind.,com.sun.imageio.,com.sun.org.apache.xerces.internal.utils.,com.sun.org.apache.xalan.internal.utils.,com.sun.org.glassfish.external.,com.sun.org.glassfish.gmbal.,apple.
security: property package.access new value sun.,com.sun.xml.internal.ws.,com.sun.xml.internal.bind.,com.sun.imageio.,com.sun.org.apache.xerces.internal.utils.,com.sun.org.apache.xalan.internal.utils.,com.sun.org.glassfish.external.,com.sun.org.glassfish.gmbal.,apple.,com.sun.javaws
security: property package.access value sun.,com.sun.xml.internal.ws.,com.sun.xml.internal.bind.,com.sun.imageio.,com.sun.org.apache.xerces.internal.utils.,com.sun.org.apache.xalan.internal.utils.,com.sun.org.glassfish.external.,com.sun.org.glassfish.gmbal.,apple.,com.sun.javaws
security: property package.access new value sun.,com.sun.xml.internal.ws.,com.sun.xml.internal.bind.,com.sun.imageio.,com.sun.org.apache.xerces.internal.utils.,com.sun.org.apache.xalan.internal.utils.,com.sun.org.glassfish.external.,com.sun.org.glassfish.gmbal.,apple.,com.sun.javaws,com.sun.deploy
security: property package.access value sun.,com.sun.xml.internal.ws.,com.sun.xml.internal.bind.,com.sun.imageio.,com.sun.org.apache.xerces.internal.utils.,com.sun.org.apache.xalan.internal.utils.,com.sun.org.glassfish.external.,com.sun.org.glassfish.gmbal.,apple.,com.sun.javaws,com.sun.deploy
security: property package.access new value sun.,com.sun.xml.internal.ws.,com.sun.xml.internal.bind.,com.sun.imageio.,com.sun.org.apache.xerces.internal.utils.,com.sun.org.apache.xalan.internal.utils.,com.sun.org.glassfish.external.,com.sun.org.glassfish.gmbal.,apple.,com.sun.javaws,com.sun.deploy,com.sun.jnlp
security: property package.definition value sun.,com.sun.xml.internal.ws.,com.sun.xml.internal.bind.,com.sun.imageio.,com.sun.org.apache.xerces.internal.utils.,com.sun.org.apache.xalan.internal.utils.,com.sun.org.glassfish.external.,com.sun.org.glassfish.gmbal.,apple.
security: property package.definition new value sun.,com.sun.xml.internal.ws.,com.sun.xml.internal.bind.,com.sun.imageio.,com.sun.org.apache.xerces.internal.utils.,com.sun.org.apache.xalan.internal.utils.,com.sun.org.glassfish.external.,com.sun.org.glassfish.gmbal.,apple.,com.sun.javaws
security: property package.definition value sun.,com.sun.xml.internal.ws.,com.sun.xml.internal.bind.,com.sun.imageio.,com.sun.org.apache.xerces.internal.utils.,com.sun.org.apache.xalan.internal.utils.,com.sun.org.glassfish.external.,com.sun.org.glassfish.gmbal.,apple.,com.sun.javaws
security: property package.definition new value sun.,com.sun.xml.internal.ws.,com.sun.xml.internal.bind.,com.sun.imageio.,com.sun.org.apache.xerces.internal.utils.,com.sun.org.apache.xalan.internal.utils.,com.sun.org.glassfish.external.,com.sun.org.glassfish.gmbal.,apple.,com.sun.javaws,com.sun.deploy
security: property package.definition value sun.,com.sun.xml.internal.ws.,com.sun.xml.internal.bind.,com.sun.imageio.,com.sun.org.apache.xerces.internal.utils.,com.sun.org.apache.xalan.internal.utils.,com.sun.org.glassfish.external.,com.sun.org.glassfish.gmbal.,apple.,com.sun.javaws,com.sun.deploy
security: property package.definition new value sun.,com.sun.xml.internal.ws.,com.sun.xml.internal.bind.,com.sun.imageio.,com.sun.org.apache.xerces.internal.utils.,com.sun.org.apache.xalan.internal.utils.,com.sun.org.glassfish.external.,com.sun.org.glassfish.gmbal.,apple.,com.sun.javaws,com.sun.deploy,com.sun.jnlp
security: property package.access value sun.,com.sun.xml.internal.ws.,com.sun.xml.internal.bind.,com.sun.imageio.,com.sun.org.apache.xerces.internal.utils.,com.sun.org.apache.xalan.internal.utils.,com.sun.org.glassfish.external.,com.sun.org.glassfish.gmbal.,apple.,com.sun.javaws,com.sun.deploy,com.sun.jnlp
security: property package.access new value sun.,com.sun.xml.internal.ws.,com.sun.xml.internal.bind.,com.sun.imageio.,com.sun.org.apache.xerces.internal.utils.,com.sun.org.apache.xalan.internal.utils.,com.sun.org.glassfish.external.,com.sun.org.glassfish.gmbal.,apple.,com.sun.javaws,com.sun.deploy,com.sun.jnlp,org.mozilla.jss
security: property package.definition value sun.,com.sun.xml.internal.ws.,com.sun.xml.internal.bind.,com.sun.imageio.,com.sun.org.apache.xerces.internal.utils.,com.sun.org.apache.xalan.internal.utils.,com.sun.org.glassfish.external.,com.sun.org.glassfish.gmbal.,apple.,com.sun.javaws,com.sun.deploy,com.sun.jnlp
security: property package.definition new value sun.,com.sun.xml.internal.ws.,com.sun.xml.internal.bind.,com.sun.imageio.,com.sun.org.apache.xerces.internal.utils.,com.sun.org.apache.xalan.internal.utils.,com.sun.org.glassfish.external.,com.sun.org.glassfish.gmbal.,apple.,com.sun.javaws,com.sun.deploy,com.sun.jnlp,org.mozilla.jss
basic: tap installed
basic: Creating PluginEmbeddedFrame served by com.apple.java.jrs.carenderserver-94472
basic: Done creating PluginEmbeddedFrame
basic: Added progress listener: sun.plugin.util.ProgressMonitorAdapter@2e01787
basic: Plugin2ClassLoader.addURL parent called for http://localhost:8080/applet-1.0.jar
security: Blacklist revocation check is enabled
security: Trusted libraries list check is enabled
network: Cache entry found [url: http://localhost:8080/applet-1.0.jar, version: null] prevalidated=false/0
cache: Adding MemoryCache entry: http://localhost:8080/applet-1.0.jar
cache: Resource http://localhost:8080/applet-1.0.jar has expired.
network: Connecting http://localhost:8080/applet-1.0.jar with proxy=DIRECT
network: Connecting http://localhost:8080/ with proxy=DIRECT
network: Connecting http://localhost:8080/applet-1.0.jar with cookie "JSESSIONID=1cexf8xz3etg2rdzdx96h1y2e"
network: ResponseCode for http://localhost:8080/applet-1.0.jar : 304
network: Encoding for http://localhost:8080/applet-1.0.jar : null
network: Disconnect connection to http://localhost:8080/applet-1.0.jar
cache: Reading Signers from 4 http://localhost:8080/applet-1.0.jar | /Users/jabourbih/Library/Application Support/Oracle/Java/Deployment/cache/6.0/5/a8cca05-5c5cc628.idx
network: No certificate info for unsigned JAR file: http://localhost:8080/applet-1.0.jar
cache: Done readCertificates(http://localhost:8080/applet-1.0.jar): null
network: No certificate info for unsigned JAR file: http://localhost:8080/applet-1.0.jar
cache: Done readSigners(http://localhost:8080/applet-1.0.jar)
cache:  Read manifest for http://localhost:8080/applet-1.0.jar: read=123 full=123
security: Trust for: http://localhost:8080/applet-1.0.jar has ended: Thu Jan 01 01:00:00 GMT 1970
security: Trust for: http://localhost:8080/applet-1.0.jar has ended: Thu Jan 01 01:00:00 GMT 1970
network: Created version ID: 1.7.0.12
network: Created version ID: 1.7.0.09
basic: Applet loaded.
basic: Applet resized and added to parent container
basic: PERF: AppletExecutionRunnable - applet.init() BEGIN ; jvmLaunch dt 234912 us, pluginInit dt 565181 us, TotalTime: 800093 us
basic: Applet initialized
basic: Starting applet
basic: completed perf rollup
basic: Applet made visible
basic: Applet started
basic: Told clients applet is started

And here is an unsuccessful one:

Log started: Thu, 10 Jan 2013 14:35:00 +0000
Java Plug-in 10.12.2.08
Using JRE version
 1.7.0_12-ea-b08 Java HotSpot(TM) 64-Bit Server VM
cache: Initialize resource manager: com.sun.deploy.cache.ResourceProviderImpl@1fc25624
security: property package.access value sun.,com.sun.xml.internal.ws.,com.sun.xml.internal.bind.,com.sun.imageio.,com.sun.org.apache.xerces.internal.utils.,com.sun.org.apache.xalan.internal.utils.,com.sun.org.glassfish.external.,com.sun.org.glassfish.gmbal.,apple.
security: property package.access new value sun.,com.sun.xml.internal.ws.,com.sun.xml.internal.bind.,com.sun.imageio.,com.sun.org.apache.xerces.internal.utils.,com.sun.org.apache.xalan.internal.utils.,com.sun.org.glassfish.external.,com.sun.org.glassfish.gmbal.,apple.,com.sun.javaws
security: property package.access value sun.,com.sun.xml.internal.ws.,com.sun.xml.internal.bind.,com.sun.imageio.,com.sun.org.apache.xerces.internal.utils.,com.sun.org.apache.xalan.internal.utils.,com.sun.org.glassfish.external.,com.sun.org.glassfish.gmbal.,apple.,com.sun.javaws
security: property package.access new value sun.,com.sun.xml.internal.ws.,com.sun.xml.internal.bind.,com.sun.imageio.,com.sun.org.apache.xerces.internal.utils.,com.sun.org.apache.xalan.internal.utils.,com.sun.org.glassfish.external.,com.sun.org.glassfish.gmbal.,apple.,com.sun.javaws,com.sun.deploy
security: property package.access value sun.,com.sun.xml.internal.ws.,com.sun.xml.internal.bind.,com.sun.imageio.,com.sun.org.apache.xerces.internal.utils.,com.sun.org.apache.xalan.internal.utils.,com.sun.org.glassfish.external.,com.sun.org.glassfish.gmbal.,apple.,com.sun.javaws,com.sun.deploy
security: property package.access new value sun.,com.sun.xml.internal.ws.,com.sun.xml.internal.bind.,com.sun.imageio.,com.sun.org.apache.xerces.internal.utils.,com.sun.org.apache.xalan.internal.utils.,com.sun.org.glassfish.external.,com.sun.org.glassfish.gmbal.,apple.,com.sun.javaws,com.sun.deploy,com.sun.jnlp
security: property package.definition value sun.,com.sun.xml.internal.ws.,com.sun.xml.internal.bind.,com.sun.imageio.,com.sun.org.apache.xerces.internal.utils.,com.sun.org.apache.xalan.internal.utils.,com.sun.org.glassfish.external.,com.sun.org.glassfish.gmbal.,apple.
security: property package.definition new value sun.,com.sun.xml.internal.ws.,com.sun.xml.internal.bind.,com.sun.imageio.,com.sun.org.apache.xerces.internal.utils.,com.sun.org.apache.xalan.internal.utils.,com.sun.org.glassfish.external.,com.sun.org.glassfish.gmbal.,apple.,com.sun.javaws
security: property package.definition value sun.,com.sun.xml.internal.ws.,com.sun.xml.internal.bind.,com.sun.imageio.,com.sun.org.apache.xerces.internal.utils.,com.sun.org.apache.xalan.internal.utils.,com.sun.org.glassfish.external.,com.sun.org.glassfish.gmbal.,apple.,com.sun.javaws
security: property package.definition new value sun.,com.sun.xml.internal.ws.,com.sun.xml.internal.bind.,com.sun.imageio.,com.sun.org.apache.xerces.internal.utils.,com.sun.org.apache.xalan.internal.utils.,com.sun.org.glassfish.external.,com.sun.org.glassfish.gmbal.,apple.,com.sun.javaws,com.sun.deploy
security: property package.definition value sun.,com.sun.xml.internal.ws.,com.sun.xml.internal.bind.,com.sun.imageio.,com.sun.org.apache.xerces.internal.utils.,com.sun.org.apache.xalan.internal.utils.,com.sun.org.glassfish.external.,com.sun.org.glassfish.gmbal.,apple.,com.sun.javaws,com.sun.deploy
security: property package.definition new value sun.,com.sun.xml.internal.ws.,com.sun.xml.internal.bind.,com.sun.imageio.,com.sun.org.apache.xerces.internal.utils.,com.sun.org.apache.xalan.internal.utils.,com.sun.org.glassfish.external.,com.sun.org.glassfish.gmbal.,apple.,com.sun.javaws,com.sun.deploy,com.sun.jnlp
security: property package.access value sun.,com.sun.xml.internal.ws.,com.sun.xml.internal.bind.,com.sun.imageio.,com.sun.org.apache.xerces.internal.utils.,com.sun.org.apache.xalan.internal.utils.,com.sun.org.glassfish.external.,com.sun.org.glassfish.gmbal.,apple.,com.sun.javaws,com.sun.deploy,com.sun.jnlp
security: property package.access new value sun.,com.sun.xml.internal.ws.,com.sun.xml.internal.bind.,com.sun.imageio.,com.sun.org.apache.xerces.internal.utils.,com.sun.org.apache.xalan.internal.utils.,com.sun.org.glassfish.external.,com.sun.org.glassfish.gmbal.,apple.,com.sun.javaws,com.sun.deploy,com.sun.jnlp,org.mozilla.jss
security: property package.definition value sun.,com.sun.xml.internal.ws.,com.sun.xml.internal.bind.,com.sun.imageio.,com.sun.org.apache.xerces.internal.utils.,com.sun.org.apache.xalan.internal.utils.,com.sun.org.glassfish.external.,com.sun.org.glassfish.gmbal.,apple.,com.sun.javaws,com.sun.deploy,com.sun.jnlp
security: property package.definition new value sun.,com.sun.xml.internal.ws.,com.sun.xml.internal.bind.,com.sun.imageio.,com.sun.org.apache.xerces.internal.utils.,com.sun.org.apache.xalan.internal.utils.,com.sun.org.glassfish.external.,com.sun.org.glassfish.gmbal.,apple.,com.sun.javaws,com.sun.deploy,com.sun.jnlp,org.mozilla.jss
basic: tap installed
basic: Creating PluginEmbeddedFrame served by com.apple.java.jrs.carenderserver-99720
basic: Done creating PluginEmbeddedFrame
basic: Added progress listener: sun.plugin.util.ProgressMonitorAdapter@67010def
basic: Plugin2ClassLoader.addURL parent called for http://localhost:8080/applet-1.0.jar
security: Blacklist revocation check is enabled
security: Trusted libraries list check is enabled
network: Cache entry found [url: http://localhost:8080/applet-1.0.jar, version: null] prevalidated=false/0
cache: Adding MemoryCache entry: http://localhost:8080/applet-1.0.jar
cache: Resource http://localhost:8080/applet-1.0.jar has expired.
network: Connecting http://localhost:8080/applet-1.0.jar with proxy=DIRECT
network: Connecting http://localhost:8080/ with proxy=DIRECT
network: ResponseCode for http://localhost:8080/applet-1.0.jar : 304
network: Encoding for http://localhost:8080/applet-1.0.jar : null
network: Disconnect connection to http://localhost:8080/applet-1.0.jar
cache: Reading Signers from 4 http://localhost:8080/applet-1.0.jar | /Users/jabourbih/Library/Application Support/Oracle/Java/Deployment/cache/6.0/5/a8cca05-721bd3f8.idx
network: No certificate info for unsigned JAR file: http://localhost:8080/applet-1.0.jar
cache: Done readCertificates(http://localhost:8080/applet-1.0.jar): null
network: No certificate info for unsigned JAR file: http://localhost:8080/applet-1.0.jar
cache: Done readSigners(http://localhost:8080/applet-1.0.jar)
cache:  Read manifest for http://localhost:8080/applet-1.0.jar: read=123 full=123
security: Trust for: http://localhost:8080/applet-1.0.jar has ended: Thu Jan 01 01:00:00 GMT 1970
security: Trust for: http://localhost:8080/applet-1.0.jar has ended: Thu Jan 01 01:00:00 GMT 1970
network: Created version ID: 1.7.0.12
network: Created version ID: 1.7.0.09
basic: Applet loaded.
basic: Applet resized and added to parent container
basic: PERF: AppletExecutionRunnable - applet.init() BEGIN ; jvmLaunch dt 284222 us, pluginInit dt 497724 us, TotalTime: 781946 us
basic: Applet initialized
basic: Starting applet
basic: completed perf rollup
basic: Applet made visible
basic: Applet started
basic: Told clients applet is started
basic: Starting applet teardown
basic: Finished applet teardown
basic: Removed progress listener: sun.plugin.util.ProgressMonitorAdapter@67010def


Note in the second invocation, there is no cookie sent to the server while retrieving the JAR file, whereas in the first one there is.

I'll attach a Maven project that will demonstrate the behaviour.
Comment 2 Jonathan Abourbih 2013-01-10 06:45:43 PST
Created attachment 182128 [details]
Maven project to demonstrate

To run the attached test case:

1. extract the tarball
2. run mvn verify
3. In your browser go to http://localhost:8080/test
4. Observe the Java Console and your cookie on the test page.
5. Note in the console the cookie (when loading the applet) matches the cookie on the page.
6. Click the reload link.
7. Note that a second console flashes open and closes right away. The trace file in ~/Library/Application Support/Oracle/Java/ shows that no cookies were passed to the applet.
Comment 3 Alexey Proskuryakov 2013-01-10 10:01:19 PST
This sounds like a Java issue to me, that should be reported to Oracle.

Plug-ins should not have their own session cookies. They should do loading through NPAPI, and then restarting a plug-in would not lose them.

For read-only access to cookies, plug-ins can use NPNURLVCookie variable.
Comment 4 Jonathan Abourbih 2013-01-10 10:06:06 PST
Thanks, Alexey. I reported it against Webkit because it doesn't seem to occur in FF. The behaviour in FF is that the plugin process does not re-launch when the page is loaded, but in Safari it is.

I've even noticed that the plugin does not even actually run any applets at all if a new page containing an applet is loaded immediately after the old page is closed.
Comment 5 Ahmad Saleem 2022-06-22 16:23:25 PDT
NPAPI support is removed from Safari 14 onward and it is not supported in Webkit Builds like WebkitGTK as well. I think this can be marked as "RESOLVED WONTFIX". Thanks!

Java plugin support was even removed earlier in Safari 12.
Comment 6 Ryosuke Niwa 2022-06-22 22:19:05 PDT
Yup, won't fix.