There’s something called a ‘java drive-by” which some private server owners are staring to do. Basically, it can allow them to auto-download and install any program they wish, this could be a remote access trojan (RAT) . It is done by a Java dialog popping up, in your web browser and asking for permission to access your computer.
Here’s an example of the message:
Once you press ‘Allow’, it can be done in the background without your knowledge
As with private server owners getting more crafty, some may try to put this on the play page, where they could bug a lot of people.
However, do not think that when Java is asking for access, it is always a drive-by. Some private server owners are starting to put Bitcoin miners on their play pages, and it asks for Java permission too (but not for access to your computer).
Generally, don’t any Java message that pops up that asks for: “access to your computer”, “unauthorized access” or for you to download a file.
To play a private server in the browser you will never need to accept any Java messages, so do not feel obligated to click them.