This version is still in development and is not considered stable yet. For the latest stable version, please use Spring Security 6.5.6!

Jackson Support

Spring Security provides Jackson 3 support for persisting Spring Security related classes. This can improve the performance of serializing Spring Security related classes when working with distributed sessions (i.e. session replication, Spring Session, etc).

Jackson 2 support is still available but deprecated for removal, so you are encouraged to migrate to Jackson 3.

To use it, register SecurityJacksonModules.getModules(ClassLoader) with JsonMapper.Builder (jackson-databind):

  • Java

  • Kotlin

ClassLoader loader = getClass().getClassLoader();
JsonMapper mapper = JsonMapper.builder()
        .addModules(SecurityJacksonModules.getModules(loader))
        .build();

// ... use JsonMapper as normally ...
SecurityContext context = new SecurityContextImpl();
// ...
String json = mapper.writeValueAsString(context);
val loader = javaClass.classLoader
val mapper = JsonMapper.builder()
    .addModules(SecurityJacksonModules.getModules(loader))
    .build()

// ... use JsonMapper as normally ...
val context: SecurityContext = SecurityContextImpl()
// ...
val json: String = mapper.writeValueAsString(context)

Using SecurityJacksonModules as above enables automatic inclusion of type information and configure a PolymorphicTypeValidator that handles the validation of class names.

If needed, you can add custom classes to the validation handling.

  • Java

  • Kotlin

ClassLoader loader = getClass().getClassLoader();
BasicPolymorphicTypeValidator.Builder builder = BasicPolymorphicTypeValidator.builder()
        .allowIfSubType(MyCustomType.class);
JsonMapper mapper = JsonMapper.builder()
        .addModules(SecurityJacksonModules.getModules(loader, builder))
        .build();
val loader = javaClass.classLoader
val builder = BasicPolymorphicTypeValidator.builder()
        .allowIfSubType(MyCustomType::class)
val mapper = JsonMapper.builder()
    .addModules(SecurityJacksonModules.getModules(loader, builder))
    .build()

The following Spring Security modules provide Jackson support: