I have developed several custom URL
handlers. They work fine when the
classes are in the system CLASSPATH,
either from an app or by placing them
in the servlet engine's CLASSPATH. However, if I package those same
classes in a JAR and drop it in
WEB-INF/lib, they're not found.

I dug into the source for java.net.URL,
and it looks to me that it tries to
load Handler classes first with
Class.forName(String) and second with the system classloader. My understanding
is that this is redundant--since
Class.forName() passes the _caller's_
ClassLoader to the underlying native forName0() method in Class.java, this again becomes the system classloader:
after all, the caller is java.lang.URL, which is always loaded from the system CLASSPATH.

The upshot: the system CLASSPATH is the only place ever checked.

Is this a JDK bug? a security feature? Is there any workaround, or do I have
to do (as I do now) a hack where I put my protocols in a separate JAR from the rest of my webapp and put that in the system CLASSPATH?

--kd