crossdomain.xml, Java, and JNLP

Joshua Marinacci has detailed how Java SE 6 update 10 supports the same crossdomain.xml that Flash supports, and how you can marry it with JNLP to allow you to do Applet mashups without permission dialogs.

The applet security model, known as the sandbox, only lets applets connect to the webserver they were loaded from. They cannot connect to anywhere else unless they are signed. Signing is great when you need access to more than what is allowed inside the sandbox, but it has two problems: the user will receive an ugly warning dialog about the applet, and the applet will have full access to the user's computer. Full access is overkill when all you want to do is talk to a webservice on another server. Surely there is some middle ground between the sandbox and full access? Well now there is.

The key is supplying a backwards compatible way of tying to the new JNLP version:

Now the JNLP file points to the the unsigned jar:

Note: you should be aware of security issues with open cross domain files.