title: Security errors on startup with Nashorn when deploying Spring application on server
body: <p>I have a Spring Webapp that throws some confusing errors on startup when I deploy it to my production server (they don't happen when I run it locally)- the errors don't seem to impact anything, so this question is more out of curiosity than a true need for help.</p>
  
  <p>Here is the stacktrace:</p>
  
  <pre><code>20-Apr-2016 17:31:31.711 INFO [localhost-startStop-1] org.apache.catalina.loader.WebappClassLoaderBase.loadClass Security Violation, attempt to use Restricted Class: jdk.internal.dynalink.support.messages_en_US
   java.security.AccessControlException: access denied ("java.lang.RuntimePermission" "accessClassInPackage.jdk.internal.dynalink.support")
      at java.security.AccessControlContext.checkPermission(AccessControlContext.java:472)
      at java.security.AccessController.checkPermission(AccessController.java:884)
      at java.lang.SecurityManager.checkPermission(SecurityManager.java:549)
      at java.lang.SecurityManager.checkPackageAccess(SecurityManager.java:1564)
      at org.apache.catalina.loader.WebappClassLoaderBase.loadClass(WebappClassLoaderBase.java:1268)
      at org.apache.catalina.loader.WebappClassLoaderBase.loadClass(WebappClassLoaderBase.java:1167)
      at java.util.ResourceBundle$Control.newBundle(ResourceBundle.java:2640)
      at java.util.ResourceBundle.loadBundle(ResourceBundle.java:1501)
      at java.util.ResourceBundle.findBundle(ResourceBundle.java:1465)
      at java.util.ResourceBundle.getBundleImpl(ResourceBundle.java:1361)
      at java.util.ResourceBundle.getBundle(ResourceBundle.java:1082)
      at java.util.logging.Logger.findResourceBundle(Logger.java:1879)
      at java.util.logging.Logger.setupResourceInfo(Logger.java:1940)
      at java.util.logging.Logger.&lt;init&gt;(Logger.java:380)
      at java.util.logging.LogManager.demandLogger(LogManager.java:554)
      at java.util.logging.Logger.demandLogger(Logger.java:455)
      at java.util.logging.Logger.getLogger(Logger.java:553)
      at jdk.internal.dynalink.support.Guards.&lt;clinit&gt;(Guards.java:101)
      at jdk.nashorn.internal.runtime.Undefined.&lt;clinit&gt;(Undefined.java:51)
      at jdk.nashorn.internal.runtime.JSType.&lt;clinit&gt;(JSType.java:263)
      at jdk.nashorn.internal.runtime.AccessorProperty.&lt;clinit&gt;(AccessorProperty.java:60)
      at jdk.nashorn.internal.objects.Global.$clinit$(Global.java)
      at jdk.nashorn.internal.objects.Global.&lt;clinit&gt;(Global.java:919)
      at jdk.nashorn.internal.runtime.Context.newGlobal(Context.java:1102)
      at jdk.nashorn.api.scripting.NashornScriptEngine$2.run(NashornScriptEngine.java:347)
      at jdk.nashorn.api.scripting.NashornScriptEngine$2.run(NashornScriptEngine.java:343)
      at java.security.AccessController.doPrivileged(Native Method)
      at jdk.nashorn.api.scripting.NashornScriptEngine.createNashornGlobal(NashornScriptEngine.java:343)
      at jdk.nashorn.api.scripting.NashornScriptEngine.&lt;init&gt;(NashornScriptEngine.java:143)
      at jdk.nashorn.api.scripting.NashornScriptEngineFactory.getScriptEngine(NashornScriptEngineFactory.java:148)
      at javax.script.ScriptEngineManager.getEngineByName(ScriptEngineManager.java:238)
      at com.my.applicationlib.security.ScriptSandbox.&lt;init&gt;(ScriptSandbox.java:60)
      at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
      at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
      at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
      at java.lang.reflect.Constructor.newInstance(Constructor.java:422)
      at org.springframework.beans.BeanUtils.instantiateClass(BeanUtils.java:147)
      at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:89)
      at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory$4.run(AbstractAutowireCapableBeanFactory.java:1089)
      at java.security.AccessController.doPrivileged(Native Method)
      ...
  </code></pre>
  
  <p>And the relevant code is as follows:</p>
  
  <pre><code>@Service
  public class ScriptSandbox {
      ScriptEngine _scriptEngine;
      AccessControlContext _accessControlContext;
  
      public ScriptSandbox() throws InstantiationException{
          ScriptEngineManager sem = new ScriptEngineManager();
          _scriptEngine = sem.getEngineByName("nashorn");//This error happens on this line.
          if (_scriptEngine==null){
              throw new InstantiationException("Could not load script engine: "+
                      "nashorn");
          }
          setPermissions(null);
     }
  }
  </code></pre>
  
  <p>I haven't been able to turn up much relevant information on google, the most I've seen is that I need it in my java security configuration. Mine looks like this so I think I have what I need:</p>
  
  <pre><code>grant {permission java.security.AllPermission; permission java.lang.RuntimePermission;};
  </code></pre>
  
  <p>Any thoughts?</p>
  
  <p>Edit: This question was marked as a duplicate of <a href="https://stackoverflow.com/questions/23917474/java-security-accesscontrolexception-access-denied-java-lang-runtimepermission">this question.</a> I don't think it is for the following reasons:</p>
  
  <p>it works just fine when I initialize nashorn later in the application it seems to work. I only get this error on bean definition from what I can tell. Don't think it's a signing issue as it only comes up on bean definition.</p>
  
  <p>Furthermore, that question has no accepted answers and few votes. Are any of those actually solutions to this problem?</p>