Logging in via oauth2 using redis session throws jackson error #3510

Activity

1. msosa

   added

   type: bugA general bugA general bug

   status: waiting-for-triageAn issue we've not yet triagedAn issue we've not yet triaged

   on Nov 23, 2025
2. bilak commented on Mar 3, 2026

   

   bilak

   on Mar 3, 2026

   More actions

   I'm facing the same issue currently. Were you able to fix/workaround it?

   I have config like this:

   @Configuration
   @EnableRedisIndexedWebSession
   public class RedisSessionConfig implements BeanClassLoaderAware {
   
       private ClassLoader loader;
   
       @Bean
       RedisSerializer<Object> springSessionDefaultRedisSerializer() {
           return new GenericJacksonJsonRedisSerializer(objectMapper());
       }
   
       private ObjectMapper objectMapper() {
           return JsonMapper.builder()
               .addModules(SecurityJacksonModules.getModules(this.loader))
               .build();
       }
   
       @Override
       public void setBeanClassLoader(final ClassLoader classLoader) {
           this.loader = classLoader;
       }
   
       @Bean
       ConfigureReactiveRedisAction configureRedisAction(final Environment environment) {
           if (environment.matchesProfiles("dragonfly")) {
               return new DragonflyConfigureNotifyKeyspaceEventsAction();
           } else {
               return new ConfigureNotifyKeyspaceEventsReactiveAction();
           }
       }
   
   }
3. bilak commented on Mar 3, 2026

   

   bilak

   on Mar 3, 2026

   More actions

   Hmm and quickly found a solution adding BasicPolymorphicTypeValidator

   private ObjectMapper objectMapper() {
           final BasicPolymorphicTypeValidator.Builder typeValidatorBuilder =
               BasicPolymorphicTypeValidator.builder()
                   .allowIfSubType(Object.class);
           
           return JsonMapper.builder()
               .addModules(SecurityJacksonModules.getModules(this.loader, typeValidatorBuilder))
               .build();
       }

   👍React with 👍1Reacted by Ievgen Kapinos
4. czp3009 commented on Apr 8, 2026

   

   czp3009

   on Apr 8, 2026

   Last edited by czp3009

   More actions

   I've encountered the same problem, it seems that the URL type was omitted after Spring Session was migrated to Jackson 3.

   The URL was present in the AllowlistTypeIdResolver of Jackson 2 in older versions, but was lost during the migration to Jackson 3.

   The URL type is used in the iss field of the OIDC token, so it's currently broken.

   A more precise and secure method for adding URL types:

   BasicPolymorphicTypeValidator.Builder ptvBuilder = BasicPolymorphicTypeValidator.builder()
                   .allowIfSubType(URL.class);

   👍React with 👍2Reacted by msosa and maritane
5. ievgen-kapinos commented on Apr 11, 2026

   

   ievgen-kapinos

   on Apr 11, 2026

   More actions

   @bilak Thank you man 🙏
6. msosa commented on Apr 15, 2026

   

   msosa

   on Apr 15, 2026

   Author

   More actions

   I created a new bug in spring security which is where I now think this bug belongs. If their team confirms I will close this one in favor of the new one