Add Allow List to Jackson Support

[rwinch]

Summary

There are some performance optimizations we can provide for jackson integration

[TanqiZhou]

org.springframework.security.authentication.BadCredentialsException is not whitelisted. If you believe this class is safe to deserialize, please provide an explicit mapping using Jackson annotations or by providing a Mixin. If the serialization is only done by a trusted source, you can also enable default typing. See #4370 for details; nested exception is java.

[chrylis]

Since the error message points to this issue, can it please get a link to documentation on enabling default typing?

[miladamery]

Since the error message points to this issue, can it please get a link to documentation on enabling default typing?

Hi. i have same issue and cant find how to enable default typing. i really appreciate if you provide a link or something else that says how to do it.

[jzheaux]

To (de)serialize a BadCredentialsException, use CoreJackson2Module:

@Bean
public ObjectMapper objectMapper() {
    ObjectMapper mapper = new ObjectMapper()
    mapper.registerModule(new CoreJackson2Module());
    // ... your other configuration
    return mapper;
}

This calls SecurityJackson2Modules.enableDefaultTyping and adds the BadCredentialsException mixin.

[TanqiZhou]

Good

[koundinya-goparaju-wcar]

I am getting the following error when I try to deserialize the OAuth2AuthenticationToken
The class with org.springframework.security.web.authentication.WebAuthenticationDetails and name of org.springframework.security.web.authentication.WebAuthenticationDetails is not in the allowlist. If you believe this class is safe to deserialize, please provide an explicit mapping using Jackson annotations or by providing a Mixin. If the serialization is only done by a trusted source, you can also enable default typing. See https://github.com/spring-projects/spring-security/issues/4370 for details (through reference chain: org.springframework.security.core.context.SecurityContextImpl["authentication"]->org.springframework.security.oauth2.client.authentication.OAuth2AuthenticationToken["details"])

[bmaassenee]

I think i found a bug in WebServletJackson2Module
with its constructor:

	public WebServletJackson2Module() {
		super(WebJackson2Module.class.getName(), new Version(1, 0, 0, null, null, null));
	}

registers it self as WebJackson2Module.class.getName(), with the result that ObjectMapper.registerModule rejects the module to be loaded because it thinks this module is already registered

[jzheaux]

@bmaassenee, please consider filing an issue if you believe you've found a bug. If you'd include a small reproducing sample in your report, that will help resolve your issue more quickly.

[tsrgithub]

{
"error_description": "OpenID Connect 1.0 UserInfo Error: The class with java.util.Collections$SingletonMap and name of java.util.Collections$SingletonMap is not in the allowlist. If you believe this class is safe to deserialize, please provide an explicit mapping using Jackson annotations or by providing a Mixin. If the serialization is only done by a trusted source, you can also enable default typing. See #4370 for details",
"error": "invalid_request",
"error_uri": "https://openid.net/specs/openid-connect-core-1_0.html#UserInfoError"
}

[rizkyJabar5]

{ "error_description": "OpenID Connect 1.0 UserInfo Error: The class with java.util.Collections$SingletonMap and name of java.util.Collections$SingletonMap is not in the allowlist. If you believe this class is safe to deserialize, please provide an explicit mapping using Jackson annotations or by providing a Mixin. If the serialization is only done by a trusted source, you can also enable default typing. See #4370 for details", "error": "invalid_request", "error_uri": "https://openid.net/specs/openid-connect-core-1_0.html#UserInfoError" }

I have the same issue too. Has there been a fix for this?

[shrralis]

The same happens in Kotlin projects, e.g. The class with kotlin.collections.EmptyList and name of kotlin.collections.EmptyList is not in the allowlist

[timadeshola]

I am getting this error when attempt to generate refresh token. Using Spring Boot authorization server v3
The class with org.springframework.security.oauth2.server.authorization.authentication.OAuth2ClientAuthenticationToken and name of org.springframework.security.oauth2.server.authorization.authentication.OAuth2ClientAuthenticationToken is not in the allowlist. If you believe this class is safe to deserialize, please provide an explicit mapping using Jackson annotations or by providing a Mixin. If the serialization is only done by a trusted source, you can also enable default typing. See https://github.com/spring-projects/spring-security/issues/4370 for details