Interop between html input type=file and java applet
I'm currently developing a web app where I make use of digital signing of forms using the portuguese citizen card and java applets.
Everything have been going smoothly with the regular forms until I reached a problem with inputs of type file. The app supports attachments so I created a separated attachment manager where the user can submit or review the attachments. When submitting it is necessary to be there two ways of doing it: normal upload or sign the file and then upload.
My first idea was to let the user select the file in the input type="file" and if he/she clicked on "sign and upload" it would launch a java applet to generate the signature to be putted in a hidden input. The problem lies in the security restrictions of html that makes the file chosen value inaccessible from javascript (which also denies access to the java applet) in some browsers.
I also thought of calculating the hash of the file to be signed on server side and then sign it on client side but that also isn't an option. The determination of the hash and it's signature must all be on client side (legal reasons).
Another idea was to use something like JUpload but it doesn't support some cases were the connection is over a SSL channel with client certificate (which can happen depending on how the login开发者_运维问答 was made on the web app).
Lastly I even had this absurd idea of open the file on the applet, sign it and then store it on a hidden input in base64. Obviously this creates a huge constrain on file size.
So my question is: What is the best approach to this problem? Any suggestions?
Thanks in advance ;)
Obviously, it is impossible to access a file selected in browser from JS or Flash. So the only way is to use a trusted Java applet. It is not an elegant way, though. Also, if your users have client certificates - what is the reason to sign it, when the communication channel is encrypted??
精彩评论