Jackson JSON Serialization in Spring Boot — Auto-Configuration

Direct Answer

When Jackson support and Spring MVC are configured, MappingJackson2HttpMessageConverter can use the configured ObjectMapper to write a compatible return value as JSON. Spring selects that converter through response-body handling and content negotiation. It is an implementation detail to describe this as intercepting the method and directly calling writeValueAsString; converters commonly write to the response stream.

Code Example

record User(Long id, String firstName, String email, LocalDateTime createdAt) {} // Java 17 record

@RestController
@RequestMapping("/api/users")
public class UserController {

    @GetMapping("/{id}")
    public User getUser(@PathVariable Long id) {
        var user = new User(1L, "Alice", "alice@example.com", LocalDateTime.now());
        return user; // Jackson serializes this to JSON automatically
    }

    @PostMapping
    public User createUser(@RequestBody User user) { // Jackson deserializes JSON to User object
        return user;
    }
}

// JSON output from getUser:
// {"id":1,"firstName":"Alice","email":"alice@example.com","createdAt":"2025-01-15T10:30:00"}

// Jackson found the record components (which have implicit getters) and serialized them

Common Mistakes & Pitfalls

• Missing getters: Freshers create POJOs with public fields but no getter methods. Jackson won't serialize those fields because it looks for getters by default. Always generate getters or use records (which have implicit getters).
• Infinite recursion: Bidirectional relationships like User has List of Orders and Order has User reference cause Jackson to loop infinitely. Fix with at-JsonIgnore on one side or at-JsonManagedReference and at-JsonBackReference.
• Sensitive data leakage: Returning entity objects directly from repositories without DTOs, exposing password hashes or internal IDs in JSON. Use dedicated response classes or at-JsonIgnore on sensitive fields.
• Wrong date format: Not configuring date serialization, leading to long timestamps instead of readable ISO-8601 strings. Records and modern Java time types handle this correctly, but older code with Date or custom types needs configuration.