Java RMI with no SecurityManager

Question

I have some older code that doesn't use a SecurityManager but does use RMI. From what I have read RMI requires a security manager, but the code seems to work and run fine on the same machine and between two machines. I have tested this stuff on 1.5, but not on 1.6.

I can't find any resource that discuss when a SecurityManager is required and when it isn't, or if that requirement changed with Java Versions.

I am going to update the code to use one, I just wanted to understand the details behind it.

Thanks for any feedback!

Answer 1

Security manager is needed only in the case when RMI downloads code from the remote machine. If both client and server use the same classes, it's not needed.

From RMI Tutorial:

A security manager determines whether downloaded code has access to the local file system or can perform any other privileged operations.

If an RMI program does not install a security manager, RMI will not download classes (other than from the local class path) for objects received as arguments or return values of remote method invocations. This restriction ensures that the operations performed by downloaded code are subject to a security policy.