gRPC Java 1.83

Apply the Java 25 baseline first. These rules cover gRPC Java 1.83 transport, metadata, interceptors, limits, retries, deadlines, reflection, and streaming.

Transport and identity

• Use NettyServerBuilder.forPort(port, ServerCredentials) with TlsServerCredentials, or a reviewed TLS SslContext configured with GrpcSslContexts; forPort(port) uses a plaintext server factory.
• Reject ManagedChannelBuilder.usePlaintext() and InsecureChannelCredentials outside an explicitly protected local transport and never derive overrideAuthority or TLS authority overrides from request input.
• Validate peer identity from transport attributes and map certificates or workload credentials to one canonical principal; metadata is not proof of transport identity.
• Require server-name and certificate-chain verification for clients and scope trust roots narrowly instead of accepting all certificates or hostnames.
• On Java 25 with Netty 4.2.0.Final through 4.2.16.Final, which predate the 4.2.17.Final fix, avoid the OpenSSL client path with a plain X509TrustManager, because it skips hostname verification there; use SslProvider.JDK or a correctly verifying X509ExtendedTrustManager, and test that trusted certificates for the wrong hostname are rejected.
• Rotate keys and certificates without silently downgrading to plaintext, and set clientAuth(TlsServerCredentials.ClientAuth.REQUIRE) when client certificates are required; test both sides of mTLS.

Metadata, interceptors, and authorization

• Set maxInboundMetadataSize below the Netty server default of 8 KiB where