Spring-security: Jackson Optimization

[rwinch]

Summary

There are some performance optimizations we can provide for jackson integration

[TanqiZhou]

org.springframework.security.authentication.BadCredentialsException is not whitelisted. If you believe this class is safe to deserialize, please provide an explicit mapping using Jackson annotations or by providing a Mixin. If the serialization is only done by a trusted source, you can also enable default typing. See https://github.com/spring-projects/spring-security/issues/4370 for details; nested exception is java.

[chrylis]

Since the error message points to this issue, can it please get a link to documentation on enabling default typing?

[miladamery]

Since the error message points to this issue, can it please get a link to documentation on enabling default typing?

Hi. i have same issue and cant find how to enable default typing. i really appreciate if you provide a link or something else that says how to do it.

[jzheaux]

To (de)serialize a BadCredentialsException, use CoreJackson2Module:

@Bean
public ObjectMapper objectMapper() {
    ObjectMapper mapper = new ObjectMapper()
    mapper.registerModule(new CoreJackson2Module());
    // ... your other configuration
    return mapper;
}

This calls SecurityJackson2Modules.enableDefaultTyping and adds the BadCredentialsException mixin.

[TanqiZhou]

Good