EVALUATION

Basically, there are two issues:

1.) Since java 1.6, the image source of an image created by plugin was changed to a byte array from a url. When an image is flushed and reconstructed, it is constructed from the in-memory byte array instead of opening the url and reading from the web.

2). Java plugin cache checks and downloads resources from web only once per browser session. This prevents updated image files on webserver being checked and downloaded.

The fix is to change url as the image source and flush plugin cache entry when image.flush() is called. This works for the classic 1.6 plugin and the new out-of-process plugin (avail in 6u10). The new plugin supports to run applets in earlier java vms (for example, 1.5 and 1.4.2). There is one scenario that the problem may still happen which is when applets are run in the new plugin and 1.4.2 jvm. Note this is not common user case. And none of the current webcam applets fall into this scenario. To workaround it, webmasters of those applets need configure their web servers to send "No-Cache" or "Expires" directives in HTTP header to tell java plugin not to cache those files.
                                     

EVALUATION

The webcam applet (use http://www.highcountrywebcams.com/webcameras_BannerElk.htm as an example) depends on Image.flush() to update images from the server. The image on the server has the same file name and supposed to be updated by the webcam frequently. Plugin implementation of AppletContext.getImage() cache images in a hash map. If Image.flush() does not nullify the cached image, the cached version will always be painted.

In the new OOPP plugin, there appears to be a separate security issue. The security manager does not permit to resove host name. In the old plugin, it has no this issue.

Exception in OOPP

access: access denied (java.net.SocketPermission www.highcountrywebcams.com resolve)
basic: Removed progress listener: sun.plugin.util.GrayBoxPainter$GrayBoxProgressListener@13bad12
Exception in thread "thread applet-View.class-1" java.security.AccessControlException: access denied (java.net.SocketPermission www.highcountrywebcams.com resolve)
        at java.security.AccessControlContext.checkPermission(Unknown Source)
        at java.security.AccessController.checkPermission(Unknown Source)
        at java.lang.SecurityManager.checkPermission(Unknown Source)
        at java.lang.SecurityManager.checkConnect(Unknown Source)
        at sun.plugin2.applet.Applet2Manager$AppletContextImpl.getImage(UnknownSource)
        at java.applet.Applet.getImage(Unknown Source)
        at java.applet.Applet.getImage(Unknown Source)
        at View.refreshImage(View.java:105)
        at View.init(View.java:81)
        at sun.plugin2.applet.Applet2Manager$AppletExecutionRunnable.run(UnknownSource)
        at java.lang.Thread.run(Unknown Source)

Domain permissions in old plugin:
 (java.net.SocketPermission www.highcountrywebcams.com connect,accept,resolve)
                                     

EVALUATION

The security exception in the new OOPP seems to be caused by a applet class (View.class) on the desktop. It looks that plugin loads the View.class from the Destktop and the applet ProtecionDomain is the Desktop which has no permission connectiong the http server. After I deleted the View.class from the Desktop, it worked fine connecting to the server.