`CoreJackson2Module` has no mixin for `OneTimeTokenAuthentication`

Open Beginner friendly
  • Is something wrong?
#19,963 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
77/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
java, spring
Domain
authentication, backend

Research direction

Read CoreJackson2Module alongside CoreJacksonModule to compare their mixin registrations, then inspect OneTimeTokenAuthenticationTests and the Jackson 2 module tests. Add coverage for serializing and deserializing OneTimeTokenAuthentication through SecurityJackson2Modules; done means the Jackson 2 round trip succeeds, including the allowlist check.

Written by the indexing model from the issue text.

Description

status: waiting-for-triage

Describe the bug

gh-18096 added Jackson support for one-time-token authentication for 7.1, but only the Jackson 3 CoreJacksonModule registers a mixin for OneTimeTokenAuthentication; the Jackson 2 CoreJackson2Module registers one for the deprecated OneTimeTokenAuthenticationToken only. Since 7.0, OneTimeTokenAuthenticationProvider and OneTimeTokenReactiveAuthenticationManager produce OneTimeTokenAuthentication, so a SecurityContext from a one-time-token login cannot be serialized with SecurityJackson2Modules, which is still the setup of applications that keep Jackson 2 for session serialization in 7.x.

To Reproduce

ObjectMapper mapper = new ObjectMapper();
mapper.registerModules(SecurityJackson2Modules.getModules(getClass().getClassLoader()));
OneTimeTokenAuthentication authentication = new OneTimeTokenAuthentication("principal",
		AuthorityUtils.createAuthorityList("ROLE_USER"));
byte[] serialized = mapper.writeValueAsBytes(authentication);
mapper.readValue(serialized, OneTimeTokenAuthentication.class);

Deserialization fails: OneTimeTokenAuthentication is not in the allowlist and has no mixin. The same round trip with SecurityJacksonModules and a Jackson 3 JsonMapper passes (OneTimeTokenAuthenticationTests).

Expected behavior

CoreJackson2Module registers a mixin for OneTimeTokenAuthentication, like CoreJacksonModule does, so that both Jackson generations can serialize what the one-time-token login produces.

Sample

Branch with the mixin (a copy of the Jackson 3 one, deprecated for removal like the rest of jackson2) and a Jackson 2 round-trip test next to the existing Jackson 3 one: https://github.com/spring-projects/spring-security/compare/main...sharanggupta:spring-security:gh-ott-authentication-jackson2-mixin. Happy to open the PR.

Dominant language
Java
Stars
9.7k
Forks
6.4k
Avg merge
1d 18h
Merged PRs (30d)
37

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from spring-projects/spring-security

All issues in spring-projects/spring-security

Similar issues

More Java issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.