"david.lloyd(a)jboss.com" wrote : And I still like my suggestion of putting stub URL handlers on the boot classpath and then replacing them with a URLStreamHandlerFactory once things get spun up. :-) Then you get a security manager from the start, and additionally you can use the real URLs in codeSource. So have we tried this? View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4188584#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...