According to the java doc "
CompletableFuture<WebSocket> java.net.http.WebSocket.Builder.buildAsync()
Builds a WebSocket.

Returns a CompletableFuture<WebSocket> which completes normally with the WebSocket when it is connected or completes exceptionally if an error occurs.

CompletableFuture may complete exceptionally with the following errors:
...
• SecurityException if a security manager is set, and the caller does not have a java.net.URLPermission for the WebSocket URI
... "

But, actually, it asks for following permissions:
1. java.net.URLPermission uri "GET:Sec-WebSocket-Key,Sec-WebSocket-Version"
2. java.lang.RuntimePermission "enableContextClassLoaderOverride"
3. java.net.SocketPermission "host:port" "connect,resolve"

There are multiple problems here:
for permission #1, is it the documented " java.net.URLPermission for the WebSocket URI "? Even yes, I suppose an example in document is needed.

for permission #2, it is apparently not documented.

for permission #3, not documented either. In addition, even I specified such permission, the test still fail.

Please refer to the attached java file.

Test output:
 java.util.concurrent.ExecutionException: java.security.AccessControlException: access denied ("java.net.SocketPermission" "127.0.0.1:45470" "connect,resolve")
at java.util.concurrent.CompletableFuture.reportGet(java.base@9-internal/CompletableFuture.java:395)
at java.util.concurrent.CompletableFuture.get(java.base@9-internal/CompletableFuture.java:1999)
at WSPermissionTest.lambda$urlPermissionTest$6(WSPermissionTest.java:196)
... 11 more
Caused by: java.security.AccessControlException: access denied ("java.net.SocketPermission" "127.0.0.1:45470" "connect,resolve")
at java.security.AccessControlContext.checkPermission(java.base@9-internal/AccessControlContext.java:468)
at java.security.AccessController.checkPermission(java.base@9-internal/AccessController.java:894)
at java.lang.SecurityManager.checkPermission(java.base@9-internal/SecurityManager.java:548)
at java.lang.SecurityManager.checkConnect(java.base@9-internal/SecurityManager.java:1050)
at sun.nio.ch.SocketChannelImpl.connect(java.base@9-internal/SocketChannelImpl.java:627)
at java.net.http.PlainHttpConnection.connect(java.httpclient@9-internal/PlainHttpConnection.java:122)
at java.net.http.Http1Exchange.sendHeadersOnly(java.httpclient@9-internal/Http1Exchange.java:133)
at java.net.http.ExchangeImpl.sendRequest(java.httpclient@9-internal/ExchangeImpl.java:176)
at java.net.http.ExchangeImpl.lambda$sendRequestAsync$1(java.httpclient@9-internal/ExchangeImpl.java:184)
at java.util.concurrent.ThreadPoolExecutor.runWorker(java.base@9-internal/ThreadPoolExecutor.java:1158)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(java.base@9-internal/ThreadPoolExecutor.java:632)
at java.lang.Thread.run(java.base@9-internal/Thread.java:843)
at jdk.internal.misc.InnocuousThread.run(java.base@9-internal/InnocuousThread.java:122)