Skip to content
Setup FoundrySetup Foundry
DESign in

Documentation

Java permissions

The `1C00` DWORD value determines the permission level for Java applets in the Internet zone.

since 0.9.8.11

Purpose

Show registry keys (2)
  • HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1C00
  • HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1C00

The 1C00 DWORD value determines the permission level for Java applets in the Internet zone. It represents the URLACTION_JAVA_PERMISSIONS URL action.

The defined value data is:

  • 0x00000000 (0): Prevents Java applets from running.
  • 0x00010000 (65536): High Safety. Applets run inside their sandbox.
  • 0x00020000 (131072): Medium Safety. Applets run in their sandbox but receive additional capabilities such as limited scratch space and user-controlled file I/O.
  • 0x00030000 (196608): Low Safety. Applets can perform high-capability operations, including file I/O.
  • 0x00800000 (8388608): Custom permissions. Although this value is defined as URLPOLICY_JAVA_CUSTOM, the Microsoft API reference states that it is not implemented.

The setting applies only to content assigned to the Internet zone (Zones\3). It does not install a Java runtime or add Java support to a component that does not otherwise provide it.

Notes

Security

Medium Safety and, especially, Low Safety expand what Java applets originating from the Internet zone can do. Under Low Safety, applets can perform operations such as file I/O. A malicious or compromised applet can therefore interact more extensively with data and system resources available in the executing user's security context.

This permission level does not automatically grant an applet administrative privileges or unrestricted access to every file. Operating-system permissions, the process security context, and other applicable security controls still apply.

High Safety confines applets to their sandbox. A value of 0 prevents them from running and removes the execution surface presented by Java applets in this zone.

Possible side effects

High Safety can restrict features required by legacy Java web applications. Disabling Java prevents applications from working when their user interface or business logic depends on a Java applet.

Notes

The value under HKCU is user-specific, while the corresponding value under HKLM belongs to the computer policy scope. If the separate “Security Zones: Use only machine settings” policy is in effect, Windows uses the machine security-zone settings instead of per-user settings.

This setting is part of the Internet Explorer security-zone model. Microsoft Edge in its normal Chromium mode does not support Java or ActiveX applets. Microsoft Edge IE mode does support ActiveX controls such as Java and Internet Explorer policies that affect security-zone settings.

Microsoft documentation

Microsoft Learn: InternetExplorer Policy CSP – InternetZoneJavaPermissions

Microsoft Learn: URL Policy Flags

Microsoft Learn: What is Internet Explorer (IE) mode?

See also