If a certain property on an object is internal to your business and not useful to a consumer, then don’t return it.

Let’s say we’re using the controller to query information and return it to the front end in the JSON data format. Often, some username and password queries are involved in the JSON data, but for security reasons, we may not need all of the User object user information (for example, username and password) to be returned to the front end.

But when we use the @RestController annotation, the returned User object is automatically converted to the corresponding JSON array and transmitted to the front end. We can’t remove the unnecessary JSON information, such as the username and password, and then return it. In order to solve this JSON data-control problem, we can use the JsonView annotation for development.

#spring-boot #java #api #web-development

Avoid Security Loopholes using @JsonView in Spring Boot
2.70 GEEK