Jackson ObjectMapper - specify serialization order of object properties

Question

I'm implementing a RESTful web service where user has to send a signed verification token along with the request so that I could ensure that the request has not been tampered by a middle man. My current implementation is as follows.

Verification token is a VerifData object serialized into a String and then hashed and encrypted.

class VerifData {     int prop1;     int prop2; } 

In my service, I put data to be serialized into an instance of VerifData and then serialize it using Jackson ObjectMapper and passed along to the verification engine along with the verification token.

VerfiData verifData = new VerifData(12345, 67890); ObjectMapper mapper = new ObjectMapper(); String verifCodeGenerated = mapper.writeValueAsString(verifData); 

But it seems that each time the application container is started, the order of properties being mapped into a string by ObjectMapper changes.

Ex: one time it would be

{"prop1":12345,"prop2":67890} 

and another time it would be

{"prop2":67890,"prop1":12345} 

So if client has serialized the VerifData instance as into the first String, there is 50% chance of it being failed even though it is correct.

Is there a way to get around this? Can I specify the order of properties to map by ObjectMapper (like in ascending order)? Or is there any other way to best implement this verification step. Both client and server implementations are developed by me. I use Java Security API for signing and verifying.

Answer 1

The annotations are useful, but can be a pain to apply everywhere. You can configure your whole ObjectMapper to work this way with

Current Jackson versions:

objectMapper.configure(MapperFeature.SORT_PROPERTIES_ALPHABETICALLY, true)

Older Jackson versions:

objectMapper.configure(SerializationConfig.Feature.SORT_PROPERTIES_ALPHABETICALLY, true);

Answer 2

From the Jackson Annotations documentation:

// ensure that "id" and "name" are output before other properties @JsonPropertyOrder({ "id", "name" })  // order any properties that don't have explicit setting using alphabetic order @JsonPropertyOrder(alphabetic=true)