如何从运行jnlp的URL获取？

Question

For my Java Web Start app I want to restrict that it can be run only from the specified domain. How can I get URL from which my app was run? I tried this way:

final BasicService bs = (BasicService) ServiceManager.lookup("javax.jnlp.BasicService");
final URL codeBase = bs.getCodeBase();

It works fine and shows me the origin but only when the codebase parameter in my jnlp file is empty. When it is set, then it shows the url for the codebase, which is wrong (when I host libs on other server) because I want the url from where my jnlp was run. For example I run my jnlp from "www.jnlpdomain.com", but the codebase is "www.libdomain.com" - in this case I would like to know the first url. When I check java console logs I can see following:

JNLP Ref (absolute): www.jnlpdomain.com/my_jnlp_file.jnlp
.... (some few lines)
=====CODEBASE=====: www.libdomain.com (this line is printed by me with the bs.getCodeBase())

So I can see that the host name is printed correctly in the first line in logs, starting with:

JNLP Ref (absolute): ....

How can I get this in my app, so I can validate the domain?

Answer 1

Look at JAR File Manifest Attributes for Security: Codebase Attribute :

The Codebase attribute is used to restrict the code base of the JAR file to specific domains. Use this attribute to prevent someone from re-deploying your application on another website for malicious purposes.