The DelegateClassLoader::getResourceAsStream should not try opening connections from URL returned by ModuleClassLoader::getResource and rely on the corresponding getResourceAsStream. That way read permissions checks are up to the ModuleClassLoader implementation.