B Security Behavior Matrix
Distinguish security-profile defaults, independent hard protections, and controls requiring explicit opt-in.
Runtime/license mode and security profile are independent. Starting with Coherence 26.1.0.0, an unset coherence.security.mode selects hardened. Select compatibility explicitly to use its column below. Explicit safe/deny settings and feature-specific policy retain their own contracts.
Compatibility-Sensitive Behavior
| Security behavior change | Compatibility profile (explicit) | Hardened profile (default starting with 26.1.0.0) | Separate switch / override |
|---|---|---|---|
| Serialization allowlist default | Does not require classes to be allowlisted, except denylisted classes still fail. | Enforces serialization allowlist. | Security config/manual allowlist can allow classes; denylist still blocks. |
| Serializer size/count limits | Unlimited/default-unbounded behavior allowed; threshold excess warns. | Finite defaults; unlimited values rejected.
|
coherence.serializer.limit.maxContainerBytes, coherence.serializer.limit.maxElements, coherence.serializer.limit.maxMapEntries; XML <limits>.
|
| XML external-entity protections | Warns/falls back/continues if required parser protections cannot be applied. | Fails closed if protections cannot be applied. | No separate feature switch found. |
| Dynamic remote payload default | Unset coherence.remote.dynamic.unauthenticated currently resolves to allow during integration.
|
The same current integration default is allow. Hardened alone does not select dynamic default-deny.
|
coherence.remote.dynamic.unauthenticated=deny|allow.
|
| Lambda bytecode missing security config | Missing security-config.xml is would_reject shadow telemetry.
|
Missing config rejects. | Add @Remote.Allowed / generated security config. Other lambda denylist/invalid checks can still reject independently.
|
| Remote executable policy | Missing named-class classification records would_reject and allows.
|
Missing named-class classification rejects. Dynamic installs may instead pass the shared dynamic gate; persisted replay is separate. | Classify named executable classes; set coherence.remote.dynamic.unauthenticated=deny explicitly to refuse dynamic installs.
|
| Function-based cache processors | Returns historical lambda/anonymous processors. | Uses classified wrapper processors needed for executable policy enforcement. | No separate switch. |
| Persisted topic policy drift | Default is warn-allow.
|
Default is reject.
|
coherence.topics.persisted.policy-drift=reject|warn-allow.
|
| REST auth fail-closed behavior | Historical fail-open behavior when REST auth context is engaged but unusable. | Requires usable principal; otherwise returns 401. | Normal REST auth configuration controls whether auth is engaged. |
| REST pass-through resources | Auto-publishes unconfigured pass-through cache resources. | Requires explicit REST resource configuration. | Explicit REST resource config allows. |
| REST direct query | Ordinary HTTP cache operations still require direct-query enablement. The legacy SSE path retains its compatibility bypass and logs. | Requires explicit resource enablement and the supported safe query subset for HTTP and SSE. | Query config direct-query enablement. |
| REST URL expressions | Raw sort/projection/aggregator/processor expressions allowed. | Requires configured aliases, except approved built-in numeric processor forms. | REST expression alias config. |
| JSON class metadata | Historical Genson class-name/fallback behavior retained. | Class literals denied; @class metadata must resolve via configured aliases; denied metadata rejected at hardened sites.
|
Configured JSON type aliases. |
| gRPC remote serializer format | Non-allowlisted client formats only record would_reject.
|
Non-default/non-allowlisted/unsafe formats reject. |
coherence.grpc.serializer.allowlist.
|
gRPC diagnostics auto defaults
|
auto keeps richer diagnostics: Channelz enabled, diagnostic error detail.
|
auto hardens: Channelz disabled, safe error disclosure.
|
coherence.grpc.channelz=enabled|disabled|auto, coherence.grpc.error-disclosure=safe|diagnostic|auto.
|
| gRPC Basic auth over cleartext | Allowed with warning. | Rejected as unauthenticated. | Use TLS/in-process; auth method controlled by coherence.grpc.auth.
|
| Management/metrics HTTP auth defaults | Default auth is none.
|
Default auth is basic.
|
Use explicit supported HTTP methods, including basic, cert, cert+basic, or none where the endpoint permits it. |
| Management TCMP unsafe request checks | Compatibility-shadow reasons are logged/allowed. | Unsafe management TCMP requests reject. | Safe allowlists/policies still allow. |
| Reporter source/output/ObjectName checks | Compatibility-shadow reasons are logged/allowed. | Unsafe Reporter paths, sources, protocols, broad ObjectNames reject. | Reporter approved roots/URL/object policies. |
| Management JMX publish URL | Dynamic RMI stub publish URL warns and is allowed. | Dynamic RMI stub publish URL rejects. | Use a safe/static JMX service URL. |
| TLS hostname verification | Null/allow verifier behavior preserved with would_reject logging.
|
Default verifier enforced; explicit unsafe allow rejected except shipped fallback maps to default verifier.
|
coherence.security.hostname.verification; custom verifier still works.
|
| DefaultController signature algorithm | Legacy weak signature algorithm allowed with warning. | Modern default; weak algorithms rejected. | External config can set a strong algorithm. |
| DefaultController subject binding | Preserves broader multi-principal compatibility once signer is verified. | Binds authorization to verified signer principal and rejects unsafe multi-principal/unbound cases. | Certificate/keystore config. |
| Subject proof for storage access | Not enforced just because a route requests proof. | Enforced only for proof-required storage-authorizer routes. | Requires subject-proof-required="true" on storage authorizer.
|
| Federation direct-connect endpoint validation | Allows unverified endpoint after configured-participant validation, with would_reject telemetry.
|
Rejects unverified endpoint. | Configure expected direct-connect endpoints. |
| RAG HuggingFace model download empty allowlist | Empty allowlist warns and permits unrestricted downloads. | Empty allowlist rejects. |
coherence.rag.security.huggingface.allowed-models.
|
| Extend InvocationService proxy default | Default enabled. | Default disabled. |
coherence.invocation.enabled=true|false or XML <invocation-service-proxy><enabled>.
|
| Concurrent Extend proxy default | Shipped default autostart remains enabled. | Shipped default autostart disabled. |
coherence.concurrent.extend.enabled=true|false.
|
Independent Protections and Requirements
| Security feature / control | Activation / switch | Relationship to coherence.security.mode
|
Notes |
|---|---|---|---|
| Senior metadata proof / senior broadcast proof |
coherence.security.peer.senior-metadata-proof.required=true
|
Independent. Disabled by default in both modes; when explicitly required, it fails closed in both modes. |
coherence.security.mode=hardened does not implicitly require senior metadata proof.
|
| Serialization built-in denylist | Built-in SerializationAllowlist exact/prefix deny entries.
|
Independent. Denylisted classes reject in both modes. | This hard deny happens before the mode-dependent allowlist-enforcement decision. |
| Object input filters and bridge-local filters | JVM-wide ObjectInputFilter.Config.getSerialFilter() plus Coherence bridge filters such as transfer metadata, persistent-store info, and management publish filters.
|
Independent. A rejection from the default, JVM, or bridge filter rejects in both modes. | These filters intersect; any rejecting delegate rejects the class. |
Wire ClassIdentity package allowlist
|
Built-in ClassIdentityAllowlist.
|
Independent. Disallowed wire-supplied class-identity packages reject in both modes. | This protects class-resolution metadata separately from the security-mode allowlist default. |
| Lambda bytecode hard checks | Built-in lambda bytecode denylist resources; emergency coherence.lambda.bytecode.allow can remove denylist entries.
|
Independent for denylisted class/method references, invalid bytecode, unsafe bytecode, and disallowed lambda targets. | Only missing security config shadowing and the dynamic-remote default are mode-dependent. |
| RAG configured allowlists | RAG allowlist configuration, including coherence.rag.security.huggingface.allowed-models when non-empty.
|
Independent once configured. Unallowlisted values reject in both modes. | Only the empty HuggingFace model-download allowlist default is mode-dependent. |
| Reporter hard input-shape rejects | Built-in Reporter validation for empty/unsafe names, invalid URIs, output URI schemes, path traversal, invalid output paths, and related malformed inputs. | Independent. These reject in both modes. | The main matrix covers Reporter cases that shadow in compatibility mode, such as outside-root or unapproved remote sources. |
| Management REST DiagnosticCommand allowlist | Built-in JFR DiagnosticCommand allowlist. | Independent. Unsupported diagnostic commands reject in both modes. | Rejections are logged with the jfr-allowlist gate.
|
Policies Requiring Their Own Configuration
TLS selection, client identity, storage authorizers, JAAS/service permissions, health-mutator enablement, and proof-provider setup remain deliberate deployment choices. Hardened policy can change endpoint defaults but does not install every required identity integration. Use Security Configuration Reference and the owning protocol chapter for explicit configuration and precedence.