8

In all of my Spring REST Web application, I have a lot of domain objects and DTOs.

I need to filter some domain object or DTOs fields based on the spring security roles of the user who makes the request. I want Jackson to filter the output JSON to allow/disallow specific class fields to be serialized , based on the Spring GrantedAuthorities roles of the user who tries to access the resource.

I can't create new DTO for every different view combination because it would be a mess.

I have found this solution :
Spring 3.2: Filtering Jackson JSON output based on Spring Security role
But it doesn't work, the filter is only applied once, when the first user logins. Then all the other users obtain the same filtering , no matter what their role is.

I cannot explain my problem better than Ray Holland on this blog post :
http://jackson-users.ning.com/forum/topics/jackson-custom-serialization
This is the exact same problem I'm trying to solve for a few days.

I couldn't find a clean way to do that so far.

1
  • create multiple mapper with different views, configured will that helps
    – Shashank
    Mar 18, 2017 at 7:18

1 Answer 1

1

It's better to use @JsonView in spring project (example)

If @JsonView isn't enough, there isn't easy solution. It is unavoidable to define specific class(interface) to implement @JsonIgnoreProperties and @JsonFilter ( take a look Jackson: Skip Objects Conditionally )

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.