We have basic authentication enabled on Tomcat6. User is authenticated in browser and then JNLP is launched to launch application in Java Web Start. On start-up, java web start tries to download jar files from server but it is not using the same session which is already authenticated by browser. Based on forums I have tried to pass session id in JNLP by using sid property as well as be appending in URL. Environment is restricted so each and every request needs to be authenticated we cannot say to exclude requests for jar file not being authenticated. Below is my JSP creating JNLP file, can anyone please help how can we continue same session to download jars which is already authenticated by Browser.
<pre>
<% response.setContentType("application/x-java-jnlp-file"); %>
<%= "<?xml version=\"1.0\" encoding=\"utf-8\"?>" %>
<!-- JNLP File for SimpleTableDemo -->
<%
String baseURL = request.getRequestURL().toString().replace(request.getRequestURI(), request.getContextPath());
%>
<jnlp codebase="<%=baseURL%>">
<information>
<title>Simple Table Demo Application</title>
<vendor>Try</vendor>
<description>SimpleTableDemo</description>
<description kind="short">An application that demonstrates a simple table.</description>
</information>
<resources>
<j2se version="1.6+" />
<property name="sid" value="<%=request.getSession().getId()%>" />
<property name="serviceHost" value="<%=request.getServerName()%>"/>
<property name="servicePort" value="<%=request.getServerPort()%>"/>
<jar href="AuthenticateJNLPJars.jar;JSESSIONID=<%=request.getSession().getId()%>" />
</resources>
<application-desc main-class="SimpleTableDemo" >
</application-desc>
</jnlp>
</pre>