Who Can an Applet Talk To?

By default an applet can just open network connections to the system from that the applet was downloaded. This system is known as the codebase. An applet cannot talk to an arbitrary system on the Internet. Any communication among different client systems must be mediated by the server.

The concern is that if connections to arbitrary hosts were permitted, then a malicious applet might be capable to make connections to other systems and launch network based attacks on other machines in an organization's internal network. This would be an especially huge problem since the machine's inside a firewall might be configured to trust each other more than they would trust any random machine from the Internet. If the internal network is properly protected through a firewall, this might be the only way an external machine could even talk to an internal machine. Additionally arbitrary network connections would permit crackers to more easily hide their true location by passing their attacks through various applet intermediaries.

HotJava, Sun's applet viewer, and Internet Explorer (but not Netscape) let you grant applets permission to open connections to any system on the Internet, by this is not enabled by default.