org.springframework.security.web.authentication.WebAuthenticationDetails is not in the allowlist #10466
Description
Describe the bug
I am using postgres database to store sessions. I am trying to store the session attributes in json.
My SessionConfiguration class is as follows
`@Configuration
public class SessionConfiguration implements BeanClassLoaderAware {
private final NotificationService notificationService;
private ClassLoader loader;
public SessionConfiguration(NotificationService notificationService) {
this.notificationService = notificationService;
}
@Bean
SessionRepositoryCustomizer<JdbcIndexedSessionRepository> sessionRepositoryCustomizer() {
return new PostgreSqlJdbcIndexedSessionRepositoryCustomizer();
}
@Bean
public ConversionServiceFactoryBean conversionService()
{
ConversionServiceFactoryBean bean = new ConversionServiceFactoryBean();
bean.setConverters(getConverters());
return bean;
}
private Set<Converter> getConverters()
{
Set<Converter> converters = new HashSet<>();
converters.add(getJsonSerializingConverter());
converters.add(getJsonDeserializingConverter());
return converters;
}
Converter<Object, byte[]> getJsonSerializingConverter() {
return new Converter<>() {
@Override
public byte[] convert(@Nonnull Object source) {
ObjectMapper objectMapper = objectMapper();
try {
return objectMapper.writeValueAsBytes(source);
} catch (IOException e) {
notificationService.send("Json serialization failed for Spring Session: " + e.getMessage(), NotificationType.SEVERE_ERROR);
}
return null;
}
};
}
Converter<byte[], Object> getJsonDeserializingConverter() {
return new Converter<>() {
@Override
public Object convert(@Nonnull byte[] source) {
ObjectMapper objectMapper = objectMapper();
try {
return objectMapper.readValue(source, Object.class);
} catch (IOException e) {
notificationService.send("Json deserialization failed for Spring Session: " + e.getMessage(), NotificationType.SEVERE_ERROR);
}
return null;
}
};
}
@Bean
ObjectMapper objectMapper() {
ObjectMapper mapper = new ObjectMapper();
mapper.registerModules(SecurityJackson2Modules.getModules(this.loader));
return mapper;
}
@Override
public void setBeanClassLoader(@Nonnull ClassLoader classLoader) {
this.loader = classLoader;
}
}I get the the following exception during the oauth2 login flow. The class with org.springframework.security.web.authentication.WebAuthenticationDetails and name of org.springframework.security.web.authentication.WebAuthenticationDetails is not in the allowlist. If you believe this class is safe to deserialize, please provide an explicit mapping using Jackson annotations or by providing a Mixin. If the serialization is only done by a trusted source, you can also enable default typing. See #4370 for details (through reference chain: org.springframework.security.core.context.SecurityContextImpl["authentication"]->org.springframework.security.oauth2.client.authentication.OAuth2AuthenticationToken["details"])`
To Reproduce
Expected behavior
It shall deserialize/serialize the security related session attributes properly.
Sample
A link to a GitHub repository with a minimal, reproducible sample.
Reports that include a sample will take priority over reports that do not.
At times, we may require a sample, so it is good to try and include a sample up front.