diff --git a/jetty-server/src/main/java/org/eclipse/jetty/server/handler/ContextHandler.java b/jetty-server/src/main/java/org/eclipse/jetty/server/handler/ContextHandler.java
index d3482ef0af2..d547539d906 100644
--- a/jetty-server/src/main/java/org/eclipse/jetty/server/handler/ContextHandler.java
+++ b/jetty-server/src/main/java/org/eclipse/jetty/server/handler/ContextHandler.java
@@ -21,7 +21,6 @@ package org.eclipse.jetty.server.handler;
 import java.io.File;
 import java.io.IOException;
 import java.io.InputStream;
-import java.lang.reflect.Method;
 import java.net.MalformedURLException;
 import java.net.URI;
 import java.net.URL;
@@ -2585,19 +2584,18 @@ public class ContextHandler extends ScopedHandler implements Attributes, Gracefu
 
             // no security manager just return the classloader
             if (!_usingSecurityManager)
+            {
                 return _classLoader;
+            }
             else
             {
                 // check to see if the classloader of the caller is the same as the context
-                // classloader, or a parent of it
+                // classloader, or a parent of it, as required by the javadoc specification.
                 try
                 {
-                    Class<?> reflect = Loader.loadClass("sun.reflect.Reflection");
-                    Method getCallerClass = reflect.getMethod("getCallerClass",Integer.TYPE);
-                    Class<?> caller = (Class<?>)getCallerClass.invoke(null,2);
-
+                    Class<?> caller = new Caller().getCallerClass(2);
                     boolean ok = false;
-                    ClassLoader callerLoader = caller.getClassLoader();
+                    ClassLoader callerLoader = caller == null ? null : caller.getClassLoader();
                     while (!ok && callerLoader != null)
                     {
                         if (callerLoader == _classLoader)
@@ -3083,4 +3081,17 @@ public class ContextHandler extends ScopedHandler implements Attributes, Gracefu
          */
         void exitScope(Context context, Request request);
     }
+
+    private static class Caller extends SecurityManager
+    {
+        public Class<?> getCallerClass(int depth)
+        {
+            if (depth < 0)
+                return null;
+            Class<?>[] classContext = getClassContext();
+            if (classContext.length <= depth)
+                return null;
+            return classContext[depth];
+        }
+    }
 }