How to Resolve the SecurityException in Java

The SecurityException is a runtime exception in Java that is thrown by the security manager to indicate a security violation. The SecurityException is an unchecked exception and does not need to be declared in the throws clause of a method or constructor.

What Causes SecurityException

The SecurityException indicates that a security violation occurred during the execution of an application. Therefore, execution cannot be further continued and has to be terminated. An example scenario of a SecurityException is using a package name for a class in code that is already defined in a signed JAR on the classpath.

SecurityException Example

Here is an example of a SecurityException thrown when using a package name that overlaps with the package name of a signed JAR file present in the classpath:

package com.rollbar.test;

public class SecurityExceptionExample {
    public static void main(String args[]) {
        System.out.println("Hello World");

        MyObject obj = new MyObject();
    }
}

In this example, the package com.rollbar.test is used for the SecurityExceptionExample class. However, this package name is already present in a signed JAR (which contains the MyObject class) in the application classpath. This causes the JVM to throw a SecurityException when the above code is executed:

Hello World
Exception in thread "main" java.lang.SecurityException: class "com.rollbar.test.MyObject"'s signer information does not match signer information of other classes in the same package
    at java.base/java.lang.ClassLoader.checkCerts(ClassLoader.java:1151)
    at java.base/java.lang.ClassLoader.preDefineClass(ClassLoader.java:906)
    at java.base/java.lang.ClassLoader.defineClass(ClassLoader.java:1015)
    at java.base/java.security.SecureClassLoader.defineClass(SecureClassLoader.java:151)
    at java.base/jdk.internal.loader.BuiltinClassLoader.defineClass(BuiltinClassLoader.java:821)
    at java.base/jdk.internal.loader.BuiltinClassLoader.findClassOnClassPathOrNull(BuiltinClassLoader.java:719)
    at java.base/jdk.internal.loader.BuiltinClassLoader.loadClassOrNull(BuiltinClassLoader.java:642)
    at java.base/jdk.internal.loader.BuiltinClassLoader.loadClass(BuiltinClassLoader.java:600)
    at java.base/jdk.internal.loader.ClassLoaders$AppClassLoader.loadClass(ClassLoaders.java:178)
    at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:522)
    at com.rollbar.test.SecurityExceptionExample.main(SecurityExceptionExample.java:7)

How to Handle SecurityException

• In cases like the example above, the package name of the application can be changed to resolve the SecurityException.
• It should also be ensured that all JAR files, especially ones that contain classes from the same packages, are signed using the same certificate. Or the signatures from the manifest of the JAR files with overlapping packages should be removed.
• A SecurityException can also be thrown when executing a JAR file. In such cases, it should be verified that the JAR file is properly signed.

Sometimes applications running with a security manager can also throw a SecurityException. This usually occurs when such applications are trying to access a system resource without the corresponding permissions. Relevant permissions must be explicitly granted to the code attempting to access such resources to make sure security violations do not occur.

Track, Analyze and Manage Errors With Rollbar

Managing Java errors and exceptions in your code is challenging. It can make deploying production code an unnerving experience. Being able to track, analyze, and manage errors in real-time can help you to proceed with more confidence. Rollbar automates error monitoring and triaging, making fixing Java errors easier than ever. Sign Up Today!