[Pattern] SecurityManager checks to explicit authorization #175

Category

security

Slug

security-manager-migration

Title

SecurityManager checks to explicit authorization

Difficulty

advanced

Since JDK

24

Summary

Replace SecurityManager-dependent checks with explicit application authorization and deployment isolation.

Old code label

SecurityManager sandbox

Old code

SecurityManager manager = System.getSecurityManager();
if (manager != null) {
    manager.checkRead(path.toString());
}
return Files.readString(path);

Modern code label

Java 24+

Modern code

Path resolved = allowedRoot.resolve(requested).normalize();
if (!resolved.startsWith(allowedRoot)) {
    throw new SecurityException("Path is outside the allowed root");
}
return Files.readString(resolved);

Explanation

The Security Manager is permanently disabled in JDK 24. Applications must enforce domain authorization explicitly and use process, container, operating-system, or module boundaries for isolation rather than relying on an in-process sandbox.

Why the modern way wins

🔍 Explicit policy — Authorization is visible in application logic.
🛡 Real isolation — OS and container boundaries protect against whole-process compromise.
🚫 Future-proof — Removes dependency on an API that can no longer be enabled.