How can I make a Java Applet do crossdomain request with client certificate and session-cookie?

Question

I have problem with a Java Applet that I can't get to send the proper cookie. The flow is as follows:

Without the crossdomain.xml file on port 80 the Applet just refuses to do any CORS request at all but with the crossdomain-file the requests comes through BUT without any cookies. However the client certificate is sent in the request.

It is also worth mentioning that the JNLP is downloaded from the same domain as the REST interface which should allow Java to communicate with that domain.

How can I make Java make the REST requests using cookies. The session cookie does not have HTTP_ONLY or Secure flag enabled.

Answer 1

Since the Java 6 Update 10 release (2008-10-15), unsigned applets can now make network connections to remote servers (servers that are different from the server that hosts the applet) using a special XML file called crossdomain.xml file. That file must be accessible on the server that the applet is trying to connect to.

You have to sign your applet, to make crossdomain requests.