Java classloader authorization model?

When loadclass () is called on classloader, does classloader first check whether the class is loaded, or delegate this check to its parent classloader immediately?

The Java API says:

However, there is a specific chapter on class loaders in the java reflection action book:

Which is right?

Solution

The correct classloader implementation will:

>Check if the course has been loaded. > The parent class loader is usually required to load the class > try to find the class in its own class path

ClassLoader. The default implementation of loadclass is similar to:

protected synchronized Class<?> loadClass(String name,boolean resolve) {
  // First,check if this class loader has directly defined the class or if the
  // JVM has initiated the class load with this class loader.
  Class<?> result = findLoadedClass(name);
  if (result == null) {
    try {
      // Next,delegate to the parent.
      result = getParent().loadClass(name);
    } catch (ClassNotFoundException ex) {
      // Finally,search locally if the parent Could not find the class.
      result = findClass(ex);
    }
  }
  // As a remnant of J2SE 1.0.2,link the class if a subclass of the class
  // loader class requested it (the JVM never calls the method,// loadClass(String) passes false,and the protected access modifier prevents
  // callers from passing true).
  if (resolve) {
    resolveClass(result);
  }
  return result;
}

Some classloader implementations will delegate to other non parent classloaders (for example, OSGi, according to the diagram of the package delegate to the classloader), and some classloader implementations will look for classes in the local classpath before delegation