`JacksonSerializer` does not respect `JsonTypeInfo`

[beroal]

To Reproduce

final MacAlgorithm macAlgorithm = Jwts.SIG.HS256;
final SecretKey secretKey = macAlgorithm.key().build();

final ObjectMapper objectMapper = new ObjectMapper();
objectMapper.addMixIn(SimpleGrantedAuthority.class, SimpleGrantedAuthorityMixin.class);
final String NAME = "additional";
final JacksonSerializer jacksonSerializer = new JacksonSerializer(objectMapper);
final JacksonDeserializer jacksonDeserializer = new JacksonDeserializer(
    objectMapper,
    Map.of(NAME, SimpleGrantedAuthority.class)
);

final JwtBuilder builder = Jwts.builder().json(jacksonSerializer);
builder.claims().add(NAME, new SimpleGrantedAuthority("ROLE_ADMIN"));
final String jwt = builder.signWith(secretKey, macAlgorithm).compact();

final JwtParser parser = Jwts.parser().json(jacksonDeserializer).verifyWith(secretKey).build();
final Object payload = parser.parse(jwt).getPayload();
System.out.println(new String((byte[]) payload));

The above program prints

{"additional":{"authority":"ROLE_ADMIN"}}

In the above program, JwtParser returns a byte[] payload.

Expected behavior

It should return Claims.

Explanation

The reason is that Jackson can't parse the payload because the JSON object corresponding to SimpleGrantedAuthority doesn't contain the "@class" property. The exception that Jackson throws is

com.fasterxml.jackson.databind.exc.InvalidTypeIdException: Could not resolve subtype of [simple type, class org.springframework.security.core.authority.SimpleGrantedAuthority]: missing type id property '@class'  at [Source: UNKNOWN; line: -1, column: -1]

The SimpleGrantedAuthorityMixin has the following annotation on it:

@JsonTypeInfo(use = JsonTypeInfo.Id.CLASS)

so the JSON object should contain the "@class" property.

BTW, JJWT drops this exception. This makes harder to understand why parsing of the payload failed.

For reference:

public final class SimpleGrantedAuthority implements GrantedAuthority {

    private static final long serialVersionUID = 620L;

    private final String role;

    public SimpleGrantedAuthority(String authority) {
        Assert.hasText(authority, "A granted authority textual representation is required");
        this.role = authority;
    }

    @Override
    public String getAuthority() {
        return this.role;
    }

    @Override
    public boolean equals(@Nullable Object obj) {
        /* skipped */
    }

    @Override
    public int hashCode() {
        return this.role.hashCode();
    }

    @Override
    public String toString() {
        return this.role;
    }

}

@JsonTypeInfo(use = JsonTypeInfo.Id.CLASS)
@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.NONE,
        getterVisibility = JsonAutoDetect.Visibility.PUBLIC_ONLY, isGetterVisibility = JsonAutoDetect.Visibility.NONE)
public abstract class SimpleGrantedAuthorityMixin {

    @JsonCreator
    public SimpleGrantedAuthorityMixin(@JsonProperty("authority") String role) {
    }

}

[lhazlewood]

You're using the .parse method which can reflect any type of payload. If you are expecting Claims, try .parseSignedClaims instead: https://github.com/jwtk/jjwt#reading-a-jws (step 4).

[beroal]

You're using the .parse method which can reflect any type of payload. If you are expecting Claims, try .parseSignedClaims instead: https://github.com/jwtk/jjwt#reading-a-jws (step 4).

I tried parseSignedClaims; it throws the following exception

Exception in thread "main" io.jsonwebtoken.UnsupportedJwtException: Unexpected content JWS.
    at io.jsonwebtoken.SupportedJwtVisitor.onVerifiedContent(SupportedJwtVisitor.java:129)
    at io.jsonwebtoken.SupportedJwtVisitor.visit(SupportedJwtVisitor.java:109)
    at io.jsonwebtoken.impl.DefaultJws.accept(DefaultJws.java:40)
    at io.jsonwebtoken.impl.DefaultJwtParser.parseSignedClaims(DefaultJwtParser.java:827)

which is caused by the aforementioned Jackson exception.

[lhazlewood]

Thanks for the update! I'll look at this later today when I'm out of meetings.

[lhazlewood]

Your mixin class has a @JsonTypeInfo(use = JsonTypeInfo.Id.CLASS) annotation that tells Jackson to look for a JSON @class key/value pair, and use the associated value as the class to instantiate.

In other words, Jackson is being told to expect something like this:

{
  "additional": {
    "@class": "org.springframework.security.core.authority.SimpleGrantedAuthority",
    "authority":"ROLE_ADMIN"
  }
}

This is not necessary however because you're already specifying the type when declaring the JJWT JacksonDeserializer:

final JacksonDeserializer jacksonDeserializer = new JacksonDeserializer(
    objectMapper,
    Map.of(NAME, SimpleGrantedAuthority.class)  // <--- already specifying a type based on the attribute name
);

Removing (or commenting out) the @JsonTypeInfo(use = JsonTypeInfo.Id.CLASS) line makes it work.

Here's my test case that works, after commenting out the JsonTypeInfo annotation, and using the .parseSignedClaims method:

package test;

import com.fasterxml.jackson.databind.ObjectMapper;
import io.jsonwebtoken.Claims;
import io.jsonwebtoken.JwtBuilder;
import io.jsonwebtoken.JwtParser;
import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.jackson.io.JacksonDeserializer;
import io.jsonwebtoken.jackson.io.JacksonSerializer;
import io.jsonwebtoken.lang.Maps;
import io.jsonwebtoken.security.MacAlgorithm;

import javax.crypto.SecretKey;

public class Issue1065Test {

    public static void main(String[] args) {

        final MacAlgorithm macAlgorithm = Jwts.SIG.HS256;
        final SecretKey secretKey = macAlgorithm.key().build();

        final ObjectMapper objectMapper = new ObjectMapper();
        objectMapper.addMixIn(SimpleGrantedAuthority.class, SimpleGrantedAuthorityMixin.class);
        final String NAME = "additional";
        final JacksonSerializer jacksonSerializer = new JacksonSerializer(objectMapper);
        final JacksonDeserializer jacksonDeserializer = new JacksonDeserializer(
                objectMapper,
                Maps.of(NAME, SimpleGrantedAuthority.class).build()
        );

        final JwtBuilder builder = Jwts.builder().json(jacksonSerializer);
        builder.claims().add(NAME, new SimpleGrantedAuthority("ROLE_ADMIN"));
        final String jwt = builder.signWith(secretKey, macAlgorithm).compact();

        final JwtParser parser = Jwts.parser().json(jacksonDeserializer).verifyWith(secretKey).build();
        final Claims claims = parser.parseSignedClaims(jwt).getPayload();
        System.out.println(claims);
    }
}

[beroal]

I made my example more realistic. Now the @class JSON attribute is needed because the NAME claim can contain any object implementing the GrantedAuthority interface.

My new example:

final MacAlgorithm macAlgorithm = Jwts.SIG.HS256;
final SecretKey secretKey = macAlgorithm.key().build();

final String NAME = "additional";
final ObjectMapper objectMapper = JsonMapper.builder()
    .addMixIn(GrantedAuthority.class, GrantedAuthorityMixin.class)
    .addMixIn(SimpleGrantedAuthority.class, SimpleGrantedAuthorityMixin.class)
    .build();
final JacksonSerializer jacksonSerializer = new JacksonSerializer(objectMapper);
final JacksonDeserializer jacksonDeserializer = new JacksonDeserializer(
    objectMapper,
    Map.of(NAME, GrantedAuthority.class)
);

final JwtBuilder builder = Jwts.builder().json(jacksonSerializer);
builder.claims().add(NAME, new SimpleGrantedAuthority("ROLE_ADMIN"));
final String jwt = builder.signWith(secretKey, macAlgorithm).compact();

final JwtParser parser = Jwts.parser().json(jacksonDeserializer).verifyWith(secretKey).build();
parser.parseSignedClaims(jwt);

Additional classes referenced in the example:

public interface GrantedAuthority extends Serializable {
    @Nullable String getAuthority();
}

@JsonTypeInfo(use = JsonTypeInfo.Id.CLASS, include = JsonTypeInfo.As.PROPERTY)
public class GrantedAuthorityMixin {
}

Without JsonTypeInfo on GrantedAuthorityMixin, Jackson throws

io.jsonwebtoken.io.DeserializationException: Unable to deserialize: Cannot construct instance of `org.springframework.security.core.GrantedAuthority` (no Creators, like default constructor, exist): abstract types either need to be mapped to concrete types, have custom deserializer, or contain additional type information
 at [Source: UNKNOWN; line: -1, column: -1]

With JsonTypeInfo on GrantedAuthorityMixin, Jackson throws

com.fasterxml.jackson.databind.exc.InvalidTypeIdException: Could not resolve subtype of [simple type, class org.springframework.security.core.GrantedAuthority]: missing type id property '@class'
 at [Source: UNKNOWN; line: -1, column: -1]

[exijn]

Hi, I'd like to investigate and work on this issue if it is still available.

I'll reproduce the behavior on the current main branch using SimpleGrantedAuthority, the Jackson mixin, and matching serializer/deserializer configuration. I'll verify whether the problem is caused by serializer configuration, claim normalization, or the parser's fallback to a byte-array payload.

If the behavior requires a library change, I'll add regression coverage for both serialization and parsing and keep the fix limited to the relevant Jackson integration.

[lhazlewood]

@hej090224 sounds great, thank you so much for the offer to help!