java - Authentication required window popping up after 7u21 update -

i've been working on project last 6 months. project have glassfish server instance webservice deployed. @ client side, i'm using javafx2.2 rest requests jersey (xml requests/responses, no json) basic authentication.

when user starts program (jws/jnlp), enter credentials in own made login window, press login button , start working. since 7u21 however, got java "authentication required" pop-up reason (probably because of changed security in 7u21).

to sure had nothing compatibility issues between java versions, updated server 7u21, so:

• client: updated java 7u17 7u21
• server: updated java 7u09 7u21, adjusted glassfish asenv.bat file use new jdk

if hit cancel button in "authentication required" window shown above, program start thou, not run stable when doing requests:

java.io.ioexception: stream closed file:/d:/netbeansprojects/mit_20130516/cl_kenom/dist/cl_kenom.jar!/gui/cow/listcow.fxml   @ com.sun.jersey.api.client.clientresponse.close(clientresponse.java:615)   @ com.sun.jersey.api.client.clientresponse.getentity(clientresponse.java:570)   @ com.sun.jersey.api.client.clientresponse.getentity(clientresponse.java:535)   @ com.sun.jersey.api.client.webresource.handle(webresource.java:696)   @ com.sun.jersey.api.client.webresource.access$300(webresource.java:74)   @ com.sun.jersey.api.client.webresource$builder.get(webresource.java:512)   @ da.cowsclient.getcowsbyuserid(cowsclient.java:96)   @ gui.cow.listcowcontroller.initialize(listcowcontroller.java:728)   @ javafx.fxml.fxmlloader.load(fxmlloader.java:2152)   @ javafx.fxml.fxmlloader.load(fxmlloader.java:2028)   @ javafx.fxml.fxmlloader.load(fxmlloader.java:2744)   @ javafx.fxml.fxmlloader.load(fxmlloader.java:2723)   @ javafx.fxml.fxmlloader.load(fxmlloader.java:2709)   @ javafx.fxml.fxmlloader.load(fxmlloader.java:2696)   @ classes.context.showcontentpane(context.java:186)   @ gui.user.listusercontroller.openadddata(listusercontroller.java:389)   @ gui.user.listusercontroller.access$100(listusercontroller.java:55)   @ gui.user.listusercontroller$8.handle(listusercontroller.java:657)   @ gui.user.listusercontroller$8.handle(listusercontroller.java:652)   @ com.sun.javafx.event.compositeeventhandler.dispatchbubblingevent(compositeeventhandler.java:69)   @ com.sun.javafx.event.eventhandlermanager.dispatchbubblingevent(eventhandlermanager.java:217)   @ com.sun.javafx.event.eventhandlermanager.dispatchbubblingevent(eventhandlermanager.java:170)   @ com.sun.javafx.event.compositeeventdispatcher.dispatchbubblingevent(compositeeventdispatcher.java:38)   @ com.sun.javafx.event.basiceventdispatcher.dispatchevent(basiceventdispatcher.java:37)   @ com.sun.javafx.event.eventdispatchchainimpl.dispatchevent(eventdispatchchainimpl.java:92)   @ com.sun.javafx.event.basiceventdispatcher.dispatchevent(basiceventdispatcher.java:35)   @ com.sun.javafx.event.eventdispatchchainimpl.dispatchevent(eventdispatchchainimpl.java:92)   @ com.sun.javafx.event.basiceventdispatcher.dispatchevent(basiceventdispatcher.java:35)   @ com.sun.javafx.event.eventdispatchchainimpl.dispatchevent(eventdispatchchainimpl.java:92)   @ com.sun.javafx.event.eventutil.fireeventimpl(eventutil.java:53)   @ com.sun.javafx.event.eventutil.fireevent(eventutil.java:33)   @ javafx.event.event.fireevent(event.java:171)   @ javafx.scene.scene$clickgenerator.postprocess(scene.java:3117)   @ javafx.scene.scene$clickgenerator.access$8600(scene.java:3055)   @ javafx.scene.scene$mousehandler.process(scene.java:3337)   @ javafx.scene.scene$mousehandler.process(scene.java:3168)   @ javafx.scene.scene$mousehandler.access$1900(scene.java:3123)   @ javafx.scene.scene.impl_processmouseevent(scene.java:1563)   @ javafx.scene.scene$scenepeerlistener.mouseevent(scene.java:2265)   @ com.sun.javafx.tk.quantum.glassvieweventhandler$mouseeventnotification.run(glassvieweventhandler.java:250)   @ com.sun.javafx.tk.quantum.glassvieweventhandler$mouseeventnotification.run(glassvieweventhandler.java:173)   @ java.security.accesscontroller.doprivileged(native method)   @ com.sun.javafx.tk.quantum.glassvieweventhandler.handlemouseevent(glassvieweventhandler.java:292)   @ com.sun.glass.ui.view.handlemouseevent(view.java:528)   @ com.sun.glass.ui.view.notifymouse(view.java:922)   @ com.sun.glass.ui.win.winapplication._runloop(native method)   @ com.sun.glass.ui.win.winapplication.access$100(winapplication.java:29)   @ com.sun.glass.ui.win.winapplication$3$1.run(winapplication.java:73)   @ java.lang.thread.run(unknown source)  com.sun.jersey.api.client.clienthandlerexception: java.io.ioexception: stream closed 

this error happens randomly when using method (haven't tested put or delete), in case getcowsbyuserid() method:

public list<cows> getcowsbyuserid(int id) throws uniforminterfaceexception {     webresource resource = webresource;     resource = resource.path(java.text.messageformat.format("cows/user/{0}", string.valueof(id))); //this line 96     list<cows> list = resource.accept(javax.ws.rs.core.mediatype.application_xml).get(new generictype<list<cows>>() { });      return list; } 

the funny part is, when start program through netbeans or .jar file instead of .jnlp, works intended (no authentication pop-ups, no errors)... must have java webstart guess?

edit 28 may 2013:

i did further research comparing java console tracing/debugging logs 7u17 , 7u21. noticed following in 7u21 log:

security: trust for: http://<url>/lib/jersey-core-1.17.jar has ended: thu jan 01 01:00:00 cet 1970 security: validate certificate chain using certpath api security: sha-256 finger print: <bunch of chars> security: certificate hasnt been expired, no need check timestamping info security: crl support disabled security: ocsp support disabled security: ocsp end entity validation disabled security: start comparing jurisdiction list certificate basic: plugin2classloader.getpermissions ceilingpolicy allperms security: javaws apppolicy permission requested for: http://<url>/lib/jersey-core-1.17.jar 

the first line not show in 7u17 log, has signing jars? shows multiple jar files same thing. when building project, gets signed own made keystore, big problem? mean jnlp work decently if jars signed certificate created trusted ca (which isn't free ofcourse)?

edit 04 june 2013:

i bought myself code signing certificate globalsign, installed onto machine. converted pfx certificate file java key store (jks) , used 1 sign jars (in netbeans). afterwards verified jars , seems ok. however, updated files on webserver, launched program through jnlp file still same behavior.. time desperate!

edit 06 june 2013:

alright, started different approach. matter of test tried fetch xml data using httpurlconnection() instead of jersey:

i same 'authentication required' window when doing http request when using 7u21. 7u17 xml response. still nobody got clue wrong? have because use basic authentication? server related? have jnlp file? more answers search question, more questions have seems :)

my answer follow-up question should answer question.

in short: java web start caches http responses default in jdk7 , have set cache-control header "no-cache, no-store" on client request , on responses jersey rest service.