[id='deserialization_whitelist']
= Adding Java Classes to Deserialization White Lists
{brandname} does not allow deserialization of arbritrary Java classes for
security reasons, which applies to JSON, XML, and marshalled `byte[]` content.

You must add Java classes to a deserialization white list, either using system
properties or specifying them in the {brandname} configuration.

.System properties

[source,options="nowrap",subs=attributes+]
----
// Specify a comma-separated list of fully qualified class names
-Dinfinispan.deserialization.whitelist.classes=java.time.Instant,com.myclass.Entity

// Specify a regular expression to match classes
-Dinfinispan.deserialization.whitelist.regexps=.*
----

.Declarative

[source,xml,options="nowrap",subs=attributes+]
----
include::config_examples/deserialization_whitelist.xml[]
----

[NOTE]
====
Java classes that you add to the deserialization whitelist apply to the
{brandname} `CacheContainer` and can be deserialized by all caches that the
`CacheContainer` controls.
====
