Secure Data Streams

Production security baseline

• Use wss and validate the complete server certificate chain.

• Use a private CA trust bundle when required; do not set an insecure or no-verify TLS mode.

• Store passwords, client private keys, and tokens in an approved secret manager. Inject them at runtime.

• Do not place credentials in the WebSocket URL, logs, shell history, configuration repositories, or AsyncAPI files.

• Grant the minimum GoldenGate role required for each administrative task and separate administration credentials from runtime consumer credentials where possible.

• Restrict network access to approved client subnets, services, and proxy routes.

• Rotate credentials and certificates without losing the durable consumer checkpoint.

Reverse proxy considerations

A reverse proxy can change the public host, path prefix, authentication mode, TLS termination point, idle timeout, maximum message size, and WebSocket upgrade behavior. Validate all of the following:

• HTTP Upgrade and Connection headers are forwarded for the WebSocket handshake.

• Idle and read timeouts exceed the expected quiet period, or ping/pong traffic keeps the connection active.

• Maximum frame and message sizes exceed the configured Data Stream record and batch sizes.

• The generated AsyncAPI YAML exposes the externally reachable host and channel address.

• Authentication headers and client certificates are passed or terminated according to the security design.

Sensitive payload data

Data Streams can expose full row images, DDL, tokens, host details, database names, and source URIs. Apply data classification, field minimization, masking or tokenization, encryption in transit and at rest, access logging, and retention controls to the consumer and every downstream copy. Avoid enabling env, sys, or all tokens unless each emitted value has been reviewed.