前置

Spring Security + Spring Session + Redis——【SecurityContext】和【AuthenticationToken】JSON反序列化问题解决方案

问题描述

Caused by: java.lang.IllegalArgumentException: The class with com.hailiu.model.Role and name of com.hailiu.model.Role is not whitelisted. If you believe this class is safe to deserialize, please provide an explicit mapping using Jackson annotations or by providing a Mixin. If the serialization is only done by a trusted source, you can also enable default typing. See https://github.com/spring-projects/spring-security/issues/4370 for details
   at org.springframework.security.jackson2.SecurityJackson2Modules$WhitelistTypeIdResolver.typeFromId(SecurityJackson2Modules.java:252) ~[spring-security-core-5.3.5.RELEASE.jar:5.3.5.RELEASE]
   at com.fasterxml.jackson.databind.jsontype.impl.TypeDeserializerBase._findDeserializer(TypeDeserializerBase.java:154) ~[jackson-databind-2.11.3.jar:2.11.3]
   at com.fasterxml.jackson.databind.jsontype.impl.AsPropertyTypeDeserializer._deserializeTypedForId(AsPropertyTypeDeserializer.java:115) ~[jackson-databind-2.11.3.jar:2.11.3]
   at com.fasterxml.jackson.databind.jsontype.impl.AsPropertyTypeDeserializer.deserializeTypedFromObject(AsPropertyTypeDeserializer.java:99) ~[jackson-databind-2.11.3.jar:2.11.3]
   at com.fasterxml.jackson.databind.deser.BeanDeserializerBase.deserializeWithType(BeanDeserializerBase.java:1209) ~[jackson-databind-2.11.3.jar:2.11.3]
   at com.fasterxml.jackson.databind.deser.std.CollectionDeserializer.deserialize(CollectionDeserializer.java:292) ~[jackson-databind-2.11.3.jar:2.11.3]
   ... 63 common frames omitted

issues

https://github.com/spring-projects/spring-security/issues/9210

问题分析

源代码

     @Overridepublic JavaType typeFromId(DatabindContext context, String id) throws IOException {DeserializationConfig config = (DeserializationConfig) context.getConfig();JavaType result = delegate.typeFromId(context, id);String className = result.getRawClass().getName();if (isWhitelisted(className)) {return result;}boolean isExplicitMixin = config.findMixInClassFor(result.getRawClass()) != null;if (isExplicitMixin) {return result;}JacksonAnnotation jacksonAnnotation = AnnotationUtils.findAnnotation(result.getRawClass(), JacksonAnnotation.class);if (jacksonAnnotation != null) {return result;}throw new IllegalArgumentException("The class with " + id + " and name of " + className + " is not whitelisted. " +"If you believe this class is safe to deserialize, please provide an explicit mapping using Jackson annotations or by providing a Mixin. " +"If the serialization is only done by a trusted source, you can also enable default typing. " +"See https://github.com/spring-projects/spring-security/issues/4370 for details");}

这异常不出现一共三个情况：

一、白名单的类

但是白名单不能继承、添加操作

二、有对应的Mixin类

三、有@JacksonAnnotation注解的类

Jackson的相关注解都有@JacksonAnnotation

解决方案

方法一

编写一个Mixin类

参考：Spring Session & RedisでJacksonを使ったシリアライズを試してみる

方法二

在对应类上加 Jackson Annotations的注解

参考文章

Spring Session & RedisでJacksonを使ったシリアライズを試してみる

Spring Security + Session Redis——JSON序列化错误[The class xxx and name of xxx is not whitelisted. ]解决方案相关推荐

Spring Security 中产生Feign 401 错误
Spring Security 中产生Feign 401 错误错误如下: Request processing failed; nested exception is feign.FeignExce ...
spring session、spring security和redis整合的简单使用
在上一篇spring session搭配redis的简单使用文章中,我们简单的使用了spring session和redis,实现了session的外部化存储,下面我们结合spring securit ...
Springboot Spring Security +Jwt+redis+mybatisPlus 动态完成前后端分离认证授权
Springboot Spring Security +Jwt 动态完成前后端分离认证授权文章目录 Springboot Spring Security +Jwt 动态完成前后端分离认证授权前 ...
6.Spring Security Session 管理
用户登录成功后,信息保存在服务器Session中,这节学习下如何管理这些Session.这节将在Spring Security短信验证码登录的基础上继续扩展. Session超时设置 Session超 ...
SpringCloud整合spring security+ oauth2+Redis实现认证授权
文章目录设置通用父工程依赖构建eureka注册中心构建认证授权服务配置文件设置 Security配置类授权服务配置类登录实现测试验证设置通用父工程依赖在微服务构建中,我们一般用一个父 ...
JAVA——json序列化错误[hibernateLazyInitializer,handler,fieldHandler]解决方案
问题描述 (to avoid exception, disable SerializationFeature.FAIL_ON_EMPTY_BEANS) (through reference chain ...
Spring security UserDetailsService autowired注入失败错误
最近使用spring mvc + spring security 实现登录权限控制的时候,一直不能成功登录,检查过后是dao一直无法注入为null CustomUserDetailConfig.jav ...
【Spring Cloud Spring Security Oauth2】Spring Security Oauth2 + Redis + Gateway网关 + Mybatis + Mysql 整合
目录一.环境要求二.源码下载地址三.参考文献四.项目预览截图说明五.oauth2.0认证授权项目 5.1 POM依赖 5.2 yml配置及启动类 5.3 认证配置与资源配置 5.4 自定义U ...
redistemplete请求spring security /oauth/token 报401错误,表示没有权限
/oauth/token 这个路径就是为了获取认证中心的token System.out.println("函数进来了");MultiValueMap<String, Str ...

Spring Security + Session Redis——JSON序列化错误[The class xxx and name of xxx is not whitelisted. ]解决方案

前置