spring-projects / spring-projects/spring-security
InvalidOneTimeTokenException does not have a Jackson Mixin
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Describe the bug
Implement OTT login, resume the OTT token to login. InvalidOneTimeTokenException was thrown. Redis failed to deserialize the session
To Reproduce
- create a spring web project with redis session
- config spring security with OTT login
- try to login again with the same token more than one time.
Expected behavior
It should know how to serialize/deserialize properly
Related issue
https://github.com/spring-projects/spring-security/issues/18095
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing OTT login with Redis-backed sessions and reusing the same token, then inspect InvalidOneTimeTokenException and the Jackson Mixin handling used during session serialization. Confirm the failure occurs while Redis deserializes the session, and verify that the exception can be serialized and deserialized correctly.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, redis, spring
- Domain
- authentication, backend, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 52/100