Security

Use this page when a Go reader accepts bytes from outside the application's trust boundary. Fory reconstructs application values; it does not authenticate the sender, protect transport integrity, or decide whether a valid value is authorized for a business operation.

Application boundary

Before deserialization:

• Authenticate the sender and protect message integrity at the transport or storage layer.
• Enforce request or file size, timeout, and concurrency limits outside Fory.
• Register only the application types the endpoint accepts and configure the reader before its first root operation.
• Validate the deserialized value against application authorization and domain rules before use.

Built-in safeguards

Security-related configuration:

• Register only the expected structs before deserializing untrusted data.
• Use WithMaxDepth(...) to reject unexpectedly deep payloads.
• Keep remote metadata size limits at their defaults unless a trusted peer needs larger metadata. Schema-version limits bound caching; additional valid schemas are decoded without caching.
• Prefer concrete struct fields over broad any or interface-typed fields for untrusted input.

Verification

Add negative tests for the boundary as well as normal round trips. Verify that the configured reader rejects unexpected application types, excessive nesting, resource-limit violations, and malformed input. After a failed read, verify that a valid root can still be read with the same Fory instance.

See Configuration for the complete option reference and Type Registration for the Fory registration API.