[id='adding-deserialization-allowlist_{context}']
= Allowing deserialization of Java classes
For security reasons {brandname} does not allow deserialization of arbitrary Java classes.
If you use `JavaSerializationMarshaller` or `GenericJBossMarshaller`, you must add your Java classes to a deserialization allow list.

[NOTE]
====
The deserialization allow list applies to the Cache Manager so your Java classes can be deserialized by all caches.
====

.Procedure

* Add Java classes to the deserialization allow list in the {brandname} configuration or in system properties.

.Declarative
[source,java,options="nowrap",subs=attributes+,role="primary"]
----
include::config_examples/deserialization_allowlist.xml[]
----

.System properties
[source,options="nowrap",subs=attributes+,role="secondary"]
----
// Specify a comma-separated list of fully qualified class names
-Dinfinispan.deserialization.allowlist.classes=java.time.Instant,com.myclass.Entity

// Specify a regular expression to match classes
-Dinfinispan.deserialization.allowlist.regexps=.*
----
