Add allowIfSubType for URL and Instant in OAuth2ClientJacksonModule

[qwerty7878]

Fixes gh-19241

Problem

Deserializing an OAuth2AuthenticationToken from a Redis session fails
with a SerializationException, because OidcIdToken stores iss as a
java.net.URL inside its claims map and the configured
PolymorphicTypeValidator denies it.

java.net.URL is present in the Jackson 2 allowlist
(AllowlistTypeIdResolver.ALLOWLIST_CLASS_NAMES) but missing from the
Jackson 3 modules.

Fix

Added allowIfSubType(URL.class) to CoreJacksonModule.
SecurityJacksonModules passes a single shared builder to every
SecurityJacksonModule, so the entry applies to the OAuth2 modules as
well.

Tests

• deserializeWhenMapContainsUrlThenDeserializes in
  SecurityJacksonModulesTests — a Map value of type URL round-trips
• deserializeWhenClaimsContainUrlThenDeserializes in
  OAuth2AuthenticationTokenMixinTests — regression test for the
  originally reported scenario

[filiphr]

I was hit by this problem as well. The Jackson 2 modules already handle this properly in

spring-security/core/src/main/java/org/springframework/security/jackson2/SecurityJackson2Modules.java

Line 245 in 5bd6b4a

names.add("java.net.URL");

.

@qwerty7878 I think that the right fix would be to do this in the CoreJacksonModule. The java.time.Instant is already there.

Maybe someone from the spring-security team can also look into this. Currently, there is a gap between the Jackson 2 and Jackson 3 support

[qwerty7878]

Thanks @filiphr, that makes sense.

The failure happens on OidcIdToken#getClaims(), which is a Map<String, Object>, so a URL can appear in any map-valued payload rather than only in the OAuth2 modules. And since SecurityJacksonModules passes a single shared builder to every SecurityJacksonModule, adding it to CoreJacksonModule covers the OAuth2 path as well.

I've moved allowIfSubType(URL.class) there and dropped the Instant entry since it's already present. The OAuth2 test is kept as a regression test for the originally reported scenario, and it passes with the fix only in core.

On the Jackson 2 / Jackson 3 gap: I compared AllowlistTypeIdResolver.ALLOWLIST_CLASS_NAMES against CoreJacksonModule entry by entry. java.net.URL is the only one present in the Jackson 2 allowlist and missing from the Jackson 3 one, so this change should close it.

[DarkAtra]

@jzheaux we're also hitting this issue. what is missing to get this PR merged?