Skip to content

[FEATURE] Add WithStrictSerialization helper to disable System.Object serialization fallback #734

Description

@Aaronontheweb

name: Feature request
about: Suggest an idea for this project
title: ''
labels: 'discussion'
assignees: ''


Is your feature request related to a problem? Please describe.

Akka.NET 1.5.66 introduced a new HOCON setting — akka.actor.serialization-settings.allow-unregistered-types — that disables the System.Object serialization fallback. When set to false, FindSerializerFor throws a SerializationException if no explicit serializer binding exists, instead of silently falling back to the default JSON serializer.

This is useful for security (preventing arbitrary type deserialization) and for catching missing serializer registrations at dev time. However, right now Akka.Hosting doesn't expose a convenient helper for this — users would need to add the raw HOCON string manually.

Describe the solution you'd like

Add a WithStrictSerialization extension method on AkkaConfigurationBuilder that sets this flag:

public static AkkaConfigurationBuilder WithStrictSerialization(
    this AkkaConfigurationBuilder builder, bool enabled = true)
{
    return builder.AddHocon(
        $"akka.actor.serialization-settings.allow-unregistered-types = {(!enabled).ToString().ToLower()}",
        HoconAddMode.Prepend);
}

Usage:

services.AddAkka("MySys", (builder, provider) =>
{
    // Disable the System.Object fallback — only explicitly registered types can serialize
    builder.WithStrictSerialization();
});

Why this API:

  • Positive framing — "strict serialization" describes what you're enabling, avoiding a double-negative around "allow unregistered types"
  • Consistent with existing patterns — follows the WithActors, WithActorRefProvider, etc. convention
  • Defaults to the security-conscious choice — calling it with no args enables strict mode, which is what people reaching for this API want
  • Reversible — pass false to explicitly keep the fallback behavior

Describe alternatives you've considered

  • Documenting the raw HOCON and leaving it at that. Works, but the config key is unwieldy (akka.actor.serialization-settings.allow-unregistered-types) and this is security-relevant enough to deserve a named helper.

Additional context

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions