Let's say you have a multi-component Java Web Start application, which is composed of a JNLP referencing your main application's JAR and multiple other JNLPs as component-desc.
For some reason, since the 1.7.0_21 version (Java SE 7 Update 21), Web Start seems to prompt the user with an installation request for all of these (the main JAR - or main JNLP - and all the JNLPs listed as component-desc entries), whereas previous versions of Web Start seemed to only prompt the user to install the main component (the top-level JNLP containing the "main" JAR).
As you can imagine, this is a serious problem as a heavily modularized application or one relying on 3rd party components and linking to their own JNLPs will end up with a pretty unfriendly startup process for the uses, who may be requested to click through a lot of dialogs before being able to start their applications.
Why is that?
I'm posting my own answer directly, as after weeks of wondering why this was happening we finally figured out the one thing that triggered this behavior. Please feel free to post your own answers to add to the discussion.
Since Java SE 7 Update 21, the Web Start launcher will treat differently remote servers using uppercase and lowercase letters in their hostnames when launching the JNLP.
Hence, launching a JNLP using the following alternate spellings will trigger different behaviors:
[EVIL] using upppercase will trigger the behavior mentioned in the question (e.g. http://MYDOMAIN.COM/webapp/webstart.jnlp)
[GOOD] using lowercase will function as expected and intended (e.g. http://maydomain.com/webapp/webstart.jnlp)
Note: The reasoning behind this isn't explained the release notes for 1.7.0_21.
Simply don't use uppercase characters when linking resources that will be loaded over the JNLP protocol via Web Start.
If your system uses uppercase hostnames (for any reason, which probably isn't a valid one - see the next section below), then do convert them to lowercase before invoking the Web Start launcher or constructing the URL that it will use for launching.
It is to be noted that the RFC952 assumes hostnames thusly (emphasis mine):
A "name" (Net, Host, Gateway, or Domain name) is a text string up to 24 characters drawn from the alphabet (A-Z), digits (0-9), minus sign (-), and period (.). Note that periods are only allowed when they serve to delimit components of "domain style names". (See RFC-921, "Domain Name System Implementation Schedule", for background). No blank or space characters are permitted as part of a name. No distinction is made between upper and lower case. The first character must be an alpha character. The last character must not be a minus sign or period. A host which serves as a GATEWAY should have "-GATEWAY" or "-GW" as part of its name. Hosts which do not serve as Internet gateways should not use "-GATEWAY" and "-GW" as part of their names. A host which is a TAC should have "-TAC" as the last part of its host name, if it is a DoD host. Single character names or nicknames are not allowed.
If your system requires uppercase characters for some reason, it's doing something wrong; as is Web Start, apparently, as of 1.7.0_21, unfortunately.
Note that I haven't seen and am not aware at this time of a bug report in Oracle's database, and that the signal for this problem seems rather low online, so other conditions may trigger this behavior. I haven't worked out a simplistic test-case yet.