Tuesday, August 25, 2009

Turn Java Security Manager Off In Google App Engine SDK

For some reasons you might want to turn Java Security Management off for Google Appengine Development Environment.

I need this for properly handling of Tapestry5 error page. With Java SecurityManager enabled it produced the following errors:

Could not initialize class org.apache.tapestry5.corelib.components.Loop

java.lang.NoClassDefFoundError: Could not initialize class


To turn it off, you should replace two classes in SDK, that are responsible to installing Security Manager.

  1. Close all Eclipse instances

  2. Locate appengine-tools-api.jar: %YOUR_ECLIPSE_FOLDER%\plugins\com.google.appengine.eclipse.sdkbundle_1.2.2.v200907291526\appengine-java-sdk-1.2.2\lib\appengine-tools-api.jar

  3. Replace original classes com\google\appengine\tools\development\DevAppServerFactory$CustomSecurityManager.class and com\google\apphosting\utils\security\SecurityManagerInstaller.class with ones provided below (you may want to do a backup first)

Thats all. Now after starting App Engine project in eclipse you should see the following output in console:

Skip install SecurityManager
Create dummy CustomSecurityManager
The server is running at http://localhost:8080/

Just keep in mind that original App Engine cloud still have those Security Managers installed.

FYI here is the sources of those classes:

package com.google.appengine.tools.development;

import java.security.Permission;

public class DevAppServerFactory {

public static class CustomSecurityManager extends SecurityManager {

public void checkPermission(Permission perm) {
// Do nothing

public CustomSecurityManager(DevAppServer devAppServer) {
System.out.println("Create dummy CustomSecurityManager");



package com.google.apphosting.utils.security;

import java.net.URL;

public class SecurityManagerInstaller {

public static void install(URL... urls) {
System.out.println("Skip install SecurityManager");


Download Google App Engine/Java 1.2.2 Security Manager patch here (3 KB)