Security
CheerpJ is a distribution of OpenJDK in WebAssembly and JavaScript. It runs Java applications, applets and libraries inside the browser tab, with no local JVM, plug-in or service on the workstation and no access to the local disk.
This page covers enterprise deployments of CheerpJ: CheerpJ Core served from your own web server or CDN, and the Applet Runner and JNLP Runner extensions distributed or self-hosted by your IT department.
CheerpJ runs your Java client application, or the original JARs. The application’s backend is not changed. How CheerpJ works explains the runtime.
The runtime comes from your web server over HTTPS, or is packaged in the extension; the application’s JARs always come from your servers. There is no server-side process, API or database.
Bytecode is executed by the CheerpJ JVM, fully inside the browser. Java objects are ordinary JavaScript objects, garbage-collected by the browser.
Java threads take turns on the page’s own thread.
Same-origin policy, CORS and Content Security Policy apply. CheerpJ adds no privileges beyond those of a normal web page, apart from the extensions’ own permissions.
No installer, local service, admin rights, Java plug-in or IE mode on the workstation.
No licence server, analytics, logging or metering. Application data travels only between the browser and your servers.
Nothing contacts Leaning Technologies or any third party, so CheerpJ runs on networks with no internet access.
Traffic uses the existing HTTPS path to your application. No inbound firewall rules are needed.
Licensing works without phoning home. There is no online licence check, and usage is never counted or reported. This holds for CheerpJ Core and the extensions alike: the licence is verified in the browser.
Java code running on CheerpJ has no direct access to the underlying system. Everything it touches goes through the runtime and the browser.
Runtime.exec is rejected, unless you supply a JavaScript function to run instead, under the same sandbox.| Deployment | Traffic |
|---|---|
| CheerpJ Core | Browser to your web server or CDN over HTTPS: the page, the runtime files, the JARs and application traffic. |
| Browser extensions | The runtime is packaged in the extension. Pages, JNLP files, JARs and application traffic go to your servers over HTTPS, as before. |
| Direct TCP (optional) | Through a Tailscale tunnel: the browser sends the connection over HTTPS to a relay you host, which opens the TCP connection to the application server. The tunnel's control server is self-hosted too. |
| Leaning Technologies and third parties | Not involved in any network traffic. |
The Applet Runner and JNLP Runner are Manifest V3 extensions for Chrome and Edge. Their distribution can be self-hosted.
Access to websites is optional for both extensions, and policy can restrict it to your application’s hosts.
Group policy sets the runtime options, such as clipboard mode, the user-agent settings and the licence token.
Force-install the extensions from an internal update URL. The public store is not needed.
How CheerpJ affects the control areas that endpoint-security frameworks assess. The scope and outcome of an assessment remain with your assessor.
| Control area | With CheerpJ | Stays with you |
|---|---|---|
| Security updates | The out-of-support desktop JRE, Java Plug-in and JInitiator can be removed from every endpoint. CheerpJ is a set of versioned files on your server, updated centrally. | Browser patching, and when to deploy a new CheerpJ release. |
| Secure configuration | No installer, local service, admin rights, plug-in or IE mode. Extension permissions and website access can be locked down by policy. | Browser and extension policy. |
| User access control | Unchanged. | Authentication and authorisation, in the application and your SSO. |
| Malware protection | Java code runs inside the browser sandbox and cannot start processes or load native binaries. | Endpoint protection, and the application's own code and dependencies. |
| Firewalls | No new inbound ports, and no outbound internet access needed. | Backend exposure, segmentation and firewall policy, including the Tailscale relay if you use one. |