title: Warning relied on Caller-Allowable-Codebase attribute not shown always
body: <p>I have the following manifest information in the signed Java applet. My build environment is old and is currently restricted to JDK 1.6.</p>
  
  <pre><code>Manifest-Version: 1.0
  Implementation-Vendor: Foo, Inc.
  Application-Library-Allowable-Codebase: * 
  Application-Name: FooBar
  Permissions: all-permissions 
  Sealed: true 
  Created-By: 1.6.0_20 (Sun Microsystems Inc.)
  Caller-Allowable-Codebase: *
  Codebase: https://*
  </code></pre>
  
  <p>According to <a href="http://docs.oracle.com/javase/8/docs/technotes/guides/deploy/manifest.html#CIHCFDCD" rel="noreferrer">Java documentation</a> -</p>
  
  <blockquote>
    <p>If a stand-alone asterisk (*) or an asterisk used with a top-level
    domain such as *.org is specified as the value for the
    Caller-Allowable-Codebase attribute, then calls from JavaScript code
    to your RIA show a security warning. Users have the choice to allow
    the call or block the call. An option to remember the choice is also
    provided. If the user chooses to remember the choice, no further
    warning messages are shown for the same RIA when it receives calls
    from JavaScript code from the same source.</p>
  </blockquote>
  
  <p>Java script code in my web application relies on the return code from the Applet to show appropriate status on the portal. The messages shown vary depending on the status code returned. But for this to happen, Java warning window should appear. In Firefox v51 &amp; JRE 1.8.121, this warning window shows up sometimes. When it doesn't, communication between JavaScript and Applet is absent. What could be issue that warning window doesn't appear all the time ?</p>