Java JSON (Jackson)

JSON is a lightweight text format for structured data exchange. It is language-agnostic and commonly used in REST APIs, messaging, and config. Jackson maps JSON to Java objects and back. {"id":1,"name":"Ana"}

Jackson is a popular library for JSON serialization/deserialization. It provides flexible data binding, tree model, and streaming APIs used in most Java backend systems. Spring Boot uses Jackson by default for JSON bodies.

Serialization = Java object -> JSON, deserialization = JSON -> Java object. Correct schema mapping is critical for API compatibility and data integrity. UserDto to JSON response and back from request body.

Core Jackson class for reading/writing JSON. ObjectMapper is thread-safe after configuration and should usually be reused as singleton bean.

ObjectMapper mapper = new ObjectMapper();
String json = mapper.writeValueAsString(user);

Reusing is faster and consistent. Recreating mapper per request increases overhead and risks inconsistent config across code paths. configure one @Bean ObjectMapper in Spring.

Data binding, tree model, and streaming model. Choose model by use case: POJO mapping for common cases, JsonNode for dynamic JSON, streaming for very large payloads. readValue (POJO), readTree (JsonNode), JsonParser (streaming).

DTO isolates API schema from domain/entity internals. Prevents accidental field leakage, lazy-loading issues, and contract breakage during refactors. expose UserResponse instead of JPA UserEntity.

Yes. Records are great immutable DTOs for clear API contracts and reduced boilerplate.

public record UserResponse(Long id, String name) {}

Controls behavior for unknown JSON fields during deserialization. Disabling can improve forward compatibility; enabling can enforce strict schema. tolerate extra fields from newer client version.

null is explicit value; missing means absent key. This difference matters for PATCH semantics and partial updates. {"name":null} vs {}

writeValueAsString. Most common serialization method in services and tests.

String json = mapper.writeValueAsString(dto);

readValue(json, Class). Ensure class fields/types align with payload schema.

UserDto dto = mapper.readValue(json, UserDto.class);

readValue(File, Class). Useful for config/bootstrap data and integration tests. loading seed JSON test data.

writeValue(File, Object). Good for exports/log snapshots; ensure encoding and file permissions. persist report data as JSON file.

Use pretty printer. Better readability for logs/debug, but avoid in high-volume production responses unless needed.

String pretty = mapper.writerWithDefaultPrettyPrinter().writeValueAsString(dto);

Convert one object type to another using Jackson mapping. Handy for DTO transformations without manual mapping in some cases. Map<String,Object> -> typed DTO.

Parse into JsonNode tree for dynamic structure access. Useful when schema is partially unknown or needs selective extraction. read only payload.meta.traceId.

Bridge between JsonNode and POJO. Useful in mixed dynamic+typed pipelines. parse root as JsonNode, convert subnode to typed class.

Preserve generic type info during deserialization. Java type erasure loses runtime generic details without TypeReference.

List<UserDto> users = mapper.readValue(json, new TypeReference<List<UserDto>>() {});

Ignoring exceptions and schema mismatch. Silent assumptions cause runtime mapping failures in production payloads. field type mismatch age:"abc" for int field.

Maps Java field/property to specific JSON key. Useful for naming mismatches and explicit contract declaration. firstName <-> "first_name".

Excludes field from serialization/deserialization. Helps hide internal/sensitive fields from API payloads. ignore internalToken.

Ignore extra JSON fields. Improves compatibility when producers add new non-breaking fields. older service reading newer payload safely.

Controls inclusion policy (e.g., non-null only). Reduces payload noise and supports clean API responses. Include.NON_NULL omits null fields.

Controls formatting for date/time/number fields. Useful for stable, explicit representation in API contracts. date pattern yyyy-MM-dd.

Accept multiple input names for same field. Helps migration/compatibility with legacy payload variants. accept first_name and firstName.

Custom getter/setter mapping names/logic. Useful when property methods need explicit JSON binding behavior. computed output field via getter.

Defines constructor/factory for deserialization. Important for immutable classes/records when custom construction needed. constructor parameter mapping with @JsonProperty.

Capture/emit dynamic key-value fields. Useful for extensible metadata sections with unknown keys. additional attributes map.

Keep annotations minimal and intentional. Too many annotations create hidden complexity; prefer clean DTOs and centralized config where possible. avoid mixing conflicting include/ignore rules.

Requires Java Time module. Without JavaTimeModule, serialization/deserialization of java.time types may fail or be undesirable format. register JavaTimeModule.

Register JavaTimeModule and configure timestamp behavior. Most APIs prefer ISO-8601 strings, not numeric timestamps.

mapper.registerModule(new JavaTimeModule());
mapper.disable(SerializationFeature.WRITE_DATES_AS_TIMESTAMPS);

Avoid timezone ambiguity. UTC simplifies distributed systems and cross-region consistency. use Instant in persistence/audit payloads.

LocalDate for date-only; Instant for absolute moment. Choose type matching business semantics to avoid confusion. birthday = LocalDate, eventCreatedAt = Instant.

For strict readable date patterns. Useful for compatibility with clients expecting exact format. @JsonFormat(pattern = "yyyy-MM-dd")

Inconsistent timezone assumptions. One service serializes in local zone, another expects UTC => shifted times. 2-hour offset bug in Europe summer time.

Usually prefer Instant/OffsetDateTime for timestamps. LocalDateTime lacks timezone/offset context, causing ambiguity across systems. same local time interpreted differently in different regions.

Standardize ObjectMapper config globally. One centralized config avoids endpoint-by-endpoint drift. shared Spring Boot Jackson config bean.

Supported with proper module/config. Ensure clients agree on representation (ISO-8601 text often best). PT15M duration.

Use explicit types + explicit timezone policy. Ambiguity is the root of most distributed time bugs. UTC Instant in JSON contracts.

Type erasure loses runtime generic info. Jackson needs TypeReference/JavaType for List<T>, Map<K,V>, etc. new TypeReference<Map<String, Object>>() {}

Use TypeReference. Prevents LinkedHashMap fallback and class cast issues.

List<UserDto> list = mapper.readValue(json, new TypeReference<List<UserDto>>() {});

TypeReference with nested generics. Strong typing avoids runtime casting risks. nested TypeReference definition.

Missing target type info. Without explicit type, Jackson chooses generic map structures. readValue(json, List.class) gives List<LinkedHashMap>.

JsonNode is richer JSON-aware API. Node API supports path traversal and type-safe checks better than raw map casts. node.path("meta").path("id").asText().

Use type metadata with care. Polymorphic deserialization is powerful but has security implications if misconfigured. sealed hierarchy DTO with controlled subtype mapping.

Explicit runtime type descriptor. Useful for advanced generic type construction via TypeFactory. collectionType for List<UserDto>.

Prefer moderate depth. Deep nesting complicates validation, client parsing, and backward compatibility. flatten unnecessary wrapper levels.

Use JsonNode or streaming parser. Avoid full object binding when only subset needed for performance. read only id and status from large payload.

Always provide explicit target type. Strong typing catches issues early and simplifies maintenance. never use raw List.class for typed lists.

JsonProcessingException and subclasses. Includes parse errors, invalid format, unknown type, mismatched input. invalid JSON syntax throws parsing exception.

JSON shape/type doesn’t match target class. Typical issue when expecting object but receiving array/string. field expects int but receives "abc".

Global exception handler mapping to 400 Bad Request. Avoid leaking stack traces; provide clear client-facing error and internal logs. @ControllerAdvice handles HttpMessageNotReadableException.

Deserialization checks structure/type; validation checks business constraints. Both are needed: JSON may parse but still violate domain rules. age parses as 5 but violates min age 18 rule.

Better client integration and debugging. Standard schema (code/message/path/timestamp/correlationId) improves operability. same error format for parse and validation failures.

Depends on contract strictness. Ignore for forward compatibility, fail for strict controlled interfaces. public API tolerate extras; internal strict pipeline may reject.

Jackson throws mapping error unless configured otherwise. You can customize handling for safer defaults or explicit rejection. unknown status string triggers 400.

Sometimes yes. Coercion can be convenient but risky; strict configs reduce surprises. "1" to int may parse, but strict mode may reject.

Security/privacy risks. Payload may contain secrets/PII; redact sensitive fields in logs. mask password/token before logging.

Fail clearly for clients, log safely for operators. Good error design improves both developer experience and incident response. 400 with field-level reason + sanitized server logs.

When default JSON output is not suitable. Use for domain-specific formatting, compact payloads, or legacy contract compatibility. money object serialized as "12.50 USD".

When input format needs custom parsing logic. Useful for non-standard formats and backward compatibility bridges. parse multiple date patterns into one field.

Via Module (SimpleModule). Central registration keeps behavior consistent and testable.

SimpleModule m = new SimpleModule();
m.addSerializer(Money.class, new MoneySerializer());
mapper.registerModule(m);

Defines how object becomes JSON. You control field shape and output tokens directly. write object with custom field names.

Defines how JSON becomes object. Handle flexible/legacy formats while preserving strong domain model. parse "Y"/"N" into boolean.

Added complexity and maintenance burden. Keep logic minimal and well-tested to avoid hidden parsing bugs. serializer/deserializer pair round-trip tests.

Per-field/class custom handler binding. Useful when only specific DTO fields need custom behavior. custom BigDecimal formatting on price field.

Prefer minimal transformation only. Keep business validation in service/validator layer for clarity and reuse. parse value in deserializer, validate rules elsewhere.

Round-trip and edge-case tests. Verify valid inputs, invalid inputs, null handling, and backward compatibility. object -> JSON -> object equality checks.

Be explicit and predictable. JSON contracts should be boring and stable, not surprising. fixed field names and deterministic formats.

Yes. Jackson is highly optimized; bottlenecks are often elsewhere (I/O, DB, network). response latency mostly DB-bound, not JSON-bound.

Very large payloads or memory-sensitive processing. Streaming reads/writes incrementally, avoiding full in-memory object trees. processing huge JSON array linearly.

Data binding easier; streaming more memory-efficient. Prefer data binding for normal payloads; streaming for scale-critical paths. export millions of records with generator.

Reusable, preconfigured read/write objects. Can improve clarity and minor performance by avoiding repeated config. one ObjectWriter for pretty logs, one for compact API output.

Serialization cost and complexity. Large object graphs can cause heavy memory use and recursion issues. bidirectional entity references causing deep trees.

Use DTO separation or Jackson reference annotations. Bidirectional relations (parent-child-parent) need explicit handling. @JsonManagedReference / @JsonBackReference.

Usually no. Lazy loading, recursion, and accidental field exposure are common risks. entity graph triggers unexpected DB queries during serialization.

Less bandwidth and faster transfer. Pretty JSON is great for humans, compact JSON for production traffic. machine-to-machine APIs use compact output.

Not by itself. Backpressure is transport/reactive concern; Jackson handles parsing/serialization step. reactive stream controls flow, Jackson maps chunks.

Measure first, optimize targeted hotspots only. Don’t over-engineer streaming/custom handlers without profiling evidence. use profiler before rewriting mapping layer.

Untrusted input can trigger vulnerabilities or resource abuse. Large/deep payloads, polymorphic misuse, and unsafe logging are common risk areas. maliciously deep JSON causing heavy parse cost.

Unsafe type handling can lead to gadget-based attacks. Never enable permissive default typing blindly on untrusted data. restrict allowed subtypes explicitly.

No. It can open attack vectors if arbitrary classes are deserialized. avoid broad global default typing for external payloads.

Limit payload size/depth and use strict DTOs. Combine parser limits, validation, and controlled type mapping. reject payload > max size at gateway/app layer.

Information leakage risk. Detailed stack/class info helps attackers and confuses clients. return generic 400 with safe message.

No. Mark sensitive fields ignored/masked and separate internal models from API DTOs. never output passwordHash/apiKey.

After successful deserialization. Parsing ensures structural validity; validation enforces business/safety rules. bean validation annotations on DTO.

Log minimal and redact sensitive fields. Operational visibility must not violate privacy/security policies. mask email/token before writing logs.

Accept only known fields/types. Reduces attack surface and unexpected behavior from extra input. strict DTO rather than Map<String,Object> for external APIs.

Treat all external JSON as untrusted input. Parse carefully, validate strictly, and expose minimal output. strict DTO + validation + sanitized errors.

Auto-configured for request/response JSON conversion. Spring’s HttpMessageConverters use ObjectMapper behind the scenes. @RequestBody and @ResponseBody serialization.

Define/configure mapper bean or Jackson2ObjectMapperBuilder. Centralized config ensures consistent behavior across controllers. global NON_NULL + JavaTimeModule.

Ignore removes field always; JsonView controls per-view exposure. JsonView can support role/context-based payload shaping but adds complexity. public vs internal response view.

Use @ControllerAdvice with exception handlers. Keeps error contract consistent for parse/validation/business failures. standardized ApiError response object.

Contract and security risks. DTO boundary prevents lazy loading surprises and field leaks. map entity -> response DTO layer.

Unit + slice/integration tests with ObjectMapper. Validate schema stability, date formats, and error handling. MockMvc assert JSON path fields.

Spring shortcut for registering custom serializers/deserializers. Useful for Spring-managed custom JSON behavior. custom serializer bean auto-discovered.

configure inclusion NON_NULL. Reduces payload size/noise while keeping contract explicit. spring.jackson.default-property-inclusion=non_null

Prevent client breakage. Favor additive changes; use versioning when breaking changes are needed. v1 and v2 response DTOs.

Centralize config and keep DTO contracts explicit. Consistency is more important than clever per-endpoint customization. one mapper policy, many predictable endpoints.

Rich ecosystem, strong performance, broad framework support. Jackson’s modules, annotations, streaming, and Spring integration make it dominant in enterprise Java. JavaTime + Kotlin + XML modules available.

Usually tolerate for forward compatibility. Policy depends on contract strictness; public APIs often ignore unknowns. @JsonIgnoreProperties(ignoreUnknown = true) for inbound DTO.

Contract tests and snapshot/schema assertions. Automated tests catch accidental field rename/type/format changes. API test asserting date format and field names.

TypeReference/JavaType. Avoid raw types to prevent runtime cast issues and hidden map fallback. new TypeReference<List<OrderDto>>() {}

Standardize on ISO-8601 + UTC policy. Consistent serialization avoids timezone drift bugs between services. Instant serialized with Z.

Reuse mapper, avoid unnecessary conversions, profile. Streaming only for truly large payload scenarios. remove object->json->object roundtrips in hot paths.

Restrict types and validate inputs. Avoid permissive polymorphism and enforce strict DTO boundaries. no global default typing on external payloads.

POJO for stable schema, JsonNode for dynamic payloads. Mixed approach is common: node for envelope, POJO for payload body. dynamic metadata + typed business section.

Annotation/config first; custom serializer when necessary. Prefer simpler maintainable options before custom code. @JsonFormat solves many date formatting needs.

Inconsistent mapper configuration across modules. Centralized config and tests prevent format/drift issues. one module writes timestamps, another writes ISO strings.

If yes, foundation is strong. This is core to API reliability and integration correctness. request JSON -> DTO -> response JSON flow.

If yes, consistency improves. Central policies reduce endpoint drift and production surprises. one shared Spring mapper bean.

If yes, typing maturity is strong. TypeReference use prevents runtime cast and map fallback issues. parse list/map nested DTOs safely.

If yes, distributed correctness improves. Time ambiguity is a major integration bug source. Instant UTC everywhere.

If yes, client/dev experience improves. Consistent 400 responses + sanitized logs are essential. controller advice for parse exceptions.

If yes, API stability/security improve. DTO boundaries decouple persistence from external contract. entity->DTO mapper layer.

If yes, production safety improves. Untrusted input + permissive typing is dangerous. strict subtype control and validation.

If yes, regressions drop. Tests should lock schema, formats, and error behavior. MockMvc JSON path assertions.

If yes, design is practical and efficient. Right model per use case avoids complexity/perf issues. stream huge exports, POJO for normal API bodies.

Keep JSON contracts explicit, stable, and secure. Jackson is powerful—use that power with consistency, validation, and clear boundaries. centralized config + DTO-first API design.