In my JNLP file, I'm using the following to make sure Java 7 users will run my application under Java 6:
<j2se version="1.6" href="http://java.sun.com/products/autodl/j2se"/>
It works, and will even prompt to install Java 6 if necessary. However, when Java 6 is installed, it is version 1.6.0.0 (!) which obviously is a security risk.
How to get JWS to download the latest version of Java 6 (or any version that's specified in the j2se tag)?
From the official documentation (emphasis mine):
The version attribute refers, by default, to a platform version (specification version) of the Java Platform Standard Edition. [...]
Exact product versions (implementation versions) may also be specified by including the href attribute.
So I guess that removing the href part should do what you expect:
<j2se version="1.6">