Question

I have a user object that is sent to and from the server. When I send out the user object, I don’t want to send the hashed password to the client. So, I added @JsonIgnore on the password property, but this also blocks it from being deserialized into the password that makes it hard to sign up users when they don’t have a password.

How can I only get @JsonIgnore to apply to serialization and not deserialization? I’m using Spring JSONView, so I don’t have a ton of control over the ObjectMapper.

Things I’ve tried:

1. Add @JsonIgnore to the property
2. Add @JsonIgnore on the getter method only

Answer 1

Exactly how to do this depends on the version of Jackson that you’re using. This changed around version 1.9, before that, you could do this by adding @JsonIgnore to the getter.

Which you’ve tried:

Add @JsonIgnore on the getter method only

Do this, and also add a specific @JsonProperty annotation for your JSON "password" field name to the setter method for the password on your object.

More recent versions of Jackson have added READ_ONLY and WRITE_ONLY annotation arguments for JsonProperty. So you could also do something like:

@JsonProperty(access = JsonProperty.Access.WRITE_ONLY)
private String password;

Docs can be found here.