CODEWITHSUNDEEP
jsonspringserializationjackson
singe3
singe3

Reputation: 2105

Jackson @JsonIgnore fields based on spring security roles

In all of my Spring REST Web application, I have a lot of domain objects and DTOs.

I need to filter some domain object or DTOs fields based on the spring security roles of the user who makes the request. I want Jackson to filter the output JSON to allow/disallow specific class fields to be serialized , based on the Spring GrantedAuthorities roles of the user who tries to access the resource.

I can't create new DTO for every different view combination because it would be a mess.

I have found this solution :
Spring 3.2: Filtering Jackson JSON output based on Spring Security role
But it doesn't work, the filter is only applied once, when the first user logins. Then all the other users obtain the same filtering , no matter what their role is.

I cannot explain my problem better than Ray Holland on this blog post :
http://jackson-users.ning.com/forum/topics/jackson-custom-serialization
This is the exact same problem I'm trying to solve for a few days.

I couldn't find a clean way to do that so far.

Upvotes: 8

Views: 4229

Answers (1)

Tody.Lu
Tody.Lu

Reputation: 975

It's better to use @JsonView in spring project (example)

If @JsonView isn't enough, there isn't easy solution. It is unavoidable to define specific class(interface) to implement @JsonIgnoreProperties and @JsonFilter ( take a look Jackson: Skip Objects Conditionally )

Upvotes: 1

Related Questions