Unravel › Java concepts › APIs and web

Learn these first

At a glance

1. 1Global behaviour is set on the ObjectMapper: registerModule(new JavaTimeModule()) for java.time, disable(SerializationFeature.WRITE_DATES_AS_TIMESTAMPS) for ISO dates, disable(FAIL_ON_UNKNOWN_PROPERTIES) to tolerate new fields from a producer
2. 2In Spring Boot, define properties (spring.jackson.*) or a Jackson2ObjectMapperBuilderCustomizer instead of creating your own mapper, so MVC, WebClient and messaging share it
3. 3A custom JsonSerializer<T> writes a value with gen.writeString(...); a JsonDeserializer<T> reads from the JsonParserAttach it with @JsonSerialize(using = ...) or register it in a SimpleModule.
4. 4@JsonView exposes different field sets to different audiences; @JsonIgnoreProperties, @JsonIdentityInfo and @JsonManagedReference tame cycles between parent and child

• Never accept polymorphic types with default typing from untrusted JSON (enableDefaultTyping, @JsonTypeInfo(use = CLASS)): it can instantiate arbitrary classes, a known remote code execution risk
• Money and large numbers: JSON numbers become double in JavaScript
• Jackson builds a serializer or deserializer per type lazily, using reflection on getters, fields and constructors guided by annotations, and caches the result

public class MoneySerializer extends JsonSerializer<BigDecimal> {    @Override    public void serialize(BigDecimal value, JsonGenerator gen, SerializerProvider provider) throws IOException {        gen.writeString(value.setScale(2, RoundingMode.HALF_UP).toPlainString());    }}public class Invoice {    @JsonSerialize(using = MoneySerializer.class)    private BigDecimal total;}

1. line 1 uses JsonSerializer, the core of Custom Jackson serialization and modules
2. line 3 uses JsonGenerator, the core of Custom Jackson serialization and modules
3. line 9 uses JsonSerialize, the core of Custom Jackson serialization and modules

How Unravel recognises it

When you paste code, Unravel looks for these signs of custom jackson serialization and modules. Spotting them yourself is a good habit when you read unfamiliar code:

• Annotations: @JsonSerialize @JsonDeserialize @JsonView @JsonAnyGetter @JsonAnySetter @JsonUnwrapped @JsonNaming @JsonPropertyOrder @JsonAlias @JsonValue @JsonManagedReference @JsonBackReference @JsonIdentityInfo
• Types: JsonSerializer JsonDeserializer SimpleModule StdSerializer StdDeserializer JavaTimeModule Jackson2ObjectMapperBuilder DeserializationFeature SerializationFeature PropertyNamingStrategies JsonGenerator JsonParser SerializerProvider DeserializationContext and 2 more

Part of a learning path

• Building and documenting APIs · previous: OpenAPI and Swagger documentation · next: GraphQL servers

Related concepts