"access denied" when using JDBC from a browser applet

I have a java applet that queries an Oracle database for data. When run from inside an IDE, it functions just fine. But when I run it as an applet embedded in a webpage, I get an "access denied" error in the class loader, and I haven't the foggiest notion what it is requiring of me:

Sep 06, 2011 12:58:48 PM oracle.jdbc.driver.OracleDriver registerMBeans
WARNING: Error while registering Oracle JDBC Diagnosability MBean.
java.security.AccessControlException: access denied ("java.lang.RuntimePermission" "getClassLoader")
                at java.security.AccessControlContext.checkPermission(Unknown Source)
                at java.security.AccessController.checkPermission(Unknown Source)
                at java.lang.SecurityManager.checkPermission(Unknown Source)
                at java.lang.Thread.getContextClassLoader(Unknown Source)
                at oracle.jdbc.driver.ClassRef.<init>(ClassRef.java:75)
                at oracle.jdbc.driver.ClassRef.newInstance(ClassRef.java:51)
                at oracle.jdbc.driver.OracleDriver.registerMBeans(OracleDriver.java:311)
                at oracle.jdbc.driver.OracleDriver$1.run(OracleDriver.java:199)
                at java.security.AccessController.doPrivileged(Native Method)
                at oracle.jdbc.driver.OracleDriver.<clinit>(OracleDriver.java:195)
                at java.lang.Class.forName0(Native Method)
                at java.lang.Class.forName(Unknown Source)
                at com.binderton.oracle.ConnectionManager.open(ConnectionManager.java:17)
                at com.sun.javafx.applet.FXApplet2$2.run(Unknown Source)
                at com.sun.javafx.application.PlatformImpl$3.run(Unknown Source)
                at com.sun.glass.ui.win.WinApplication._runLoop(Native Method)
                at com.sun.glass.ui.win.WinApplication.access$100(Unknown Source)
                at com.sun.glass.ui.win.WinApplication$1$1.run(Unknown Source)
                at java.lang.Thread.run(Unknown Source)
java.lang.ExceptionInInitializerError
                at java.lang.Class.forName0(Native Method)
                at java.lang.Class.forName(Unknown Source)
                at com.binderton.oracle.ConnectionManager.open(ConnectionManager.java:17)
                at com.sun.javafx.applet.FXApplet2$2.run(Unknown Source)
                at com.sun.javafx.application.PlatformImpl$3.run(Unknown Source)
          开发者_如何学Python      at com.sun.glass.ui.win.WinApplication._runLoop(Native Method)
                at com.sun.glass.ui.win.WinApplication.access$100(Unknown Source)
                at com.sun.glass.ui.win.WinApplication$1$1.run(Unknown Source)
                at java.lang.Thread.run(Unknown Source)
Caused by: java.security.AccessControlException: access denied ("java.lang.RuntimePermission" getClassLoader")
                at java.security.AccessControlContext.checkPermission(Unknown Source)
                at java.security.AccessController.checkPermission(Unknown Source)
                at java.lang.SecurityManager.checkPermission(Unknown Source)
                at java.lang.Thread.getContextClassLoader(Unknown Source)
                at oracle.jdbc.driver.ClassRef.<init>(ClassRef.java:75)
                at oracle.jdbc.driver.ClassRef.newInstance(ClassRef.java:51)
                at oracle.jdbc.driver.OracleDriver.<clinit>(OracleDriver.java:260)
                ... 12 more
Got ErrorEvent[url=null label=Failed to start application. cause=null

Applets runs in an environment with very restrictive security rules. You need at least to sign your applet.

But, the problem is bigger here, doing JDBC inside an applet is a very bad idea. The applet's source code is publicitly available and is thus sensitive for easy hacks. You should really create a webservice for that instead and then let your applet access that webservice instead. With a webservice, your applet will be able to exchange information with the DB by just HTTP requests/responses. With a webservice you hide the DB access details, JDBC and SQL code from the public.

How exactly to create a webservice depends on the server environment and the programming language used. In Java EE for example, you could already use a simple Servlet for this, but also JAX-RS and JAX-WS is supported for restful (XML/JSON) and XML webservices respectively. An applet is without any security restrictions allowed to connect with its host whose address is available by getCodeBase() E.g.

InputStream response = new URL(getCodeBase(), "servlet?foo=bar").openStream();
// ...

Note that if you follow the advice of BalusC and hide the DB behind a an active page (e.g. a servlet, PHP, ASP etc.) that is on the same server as the applet, the applet could most probably remain sand-boxed. It would be the active page that is trying to access class-loaders (as well as the DB).