If a JNLP applet requests all-permissions but has code in a unsigned jar, plugin does not run the applet and show the error panel in browser. A com.sun.deploy.net.JARSigningException: Found unsigned entry in resource: is thrown.

However, if you reload the page, then the applet runs in sand box permissions.

Close the browser, open it again and revisit the page. The applet runs in sand box.

Close the browser, clear the deployment cache and revisit the page. Plugin throw the above exception and show the error panel.

The expected behavior should be that plugin always throw exception and never run the applet. The inconsistent behavior is probably caused by caching the signing information.