Jax-RS #JsonIgnore not working after adding the service endpoint to Application.getClasses - json

Question

I'm working on my first REST API and I had it working for a minute. Basically, I have a Entity class User which has a reference to another database table Bookmark. I used #JsonIgnore at that field to exclude it from User's JSON representation:
import org.codehaus.jackson.annotate.JsonIgnore;
import javax.persistence.*;
#Entity
#Table(name = "user")
public class User implements Serializable {
private static final long serialVersionUID = 1L;
#Id
private String id;
#OneToMany(cascade = CascadeType.ALL, mappedBy = "user", fetch = FetchType.LAZY)
#JsonIgnore
private List<Bookmark> bookmarks = new ArrayList<>();
#Column(name = "name")
private String name;
}
To get it running, I added an Application class (empty for now):
import javax.ws.rs.ApplicationPath;
import javax.ws.rs.core.Application;
#ApplicationPath("/api")
public class RestApplication extends Application {
}
And finally, I took my good old UserService and added a REST endpoint:
#Dependent
#Named
#Path("/userService")
public class UserService {
#Inject
private UserDAO userDAO;
#GET
#Path("/getUserById/{id}")
#Produces(MediaType.APPLICATION_JSON)
public User getUserById(#PathParam("id") String id) {
return userDAO.getUserById(id);
}
}
Now I was able to access .../api/userService/getUserById/XYZ and get back a JSON representation of User including only id and name.
However, when trying to access the API from a second project running on the same machine, I stumbled upon the necessity to enable Cross-Origin Resource Sharing. I did so by following the many online guides and implemented a CorsFilter:
import java.io.IOException;
import javax.ws.rs.container.ContainerRequestContext;
import javax.ws.rs.container.ContainerResponseContext;
import javax.ws.rs.container.ContainerResponseFilter;
import javax.ws.rs.ext.Provider;
#Provider
public class CorsFilter implements ContainerResponseFilter {
#Override
public void filter(ContainerRequestContext requestContext, ContainerResponseContext responseContext)
throws IOException {
responseContext.getHeaders().add("Access-Control-Allow-Origin", "*");
responseContext.getHeaders().add("Access-Control-Allow-Credentials", "true");
responseContext.getHeaders().add("Access-Control-Allow-Headers", "origin, content-type, accept, authorization");
responseContext.getHeaders().add("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS, HEAD");
}
}
It had no effect at first, but it worked when I included CorsFilter.class in the RestApplication's getClasses() method. Curling the API now showed the correct headers with CORS enabled, but the endpoints returned nothing, so I also included the UserService.class.
That's my RestApplication class right now:
import java.util.HashSet;
import java.util.Set;
import javax.ws.rs.ApplicationPath;
import javax.ws.rs.core.Application;
#ApplicationPath("/api")
public class RestApplication extends Application {
#Override
public Set<Class<?>> getClasses() {
final Set<Class<?>> classes = new HashSet<>();
classes.add(UserService.class);
classes.add(CorsFilter.class);
return classes;
}
}
However, now I get the infamous RESTEASY008205: JSON Binding serialization error org.hibernate.LazyInitializationException: failed to lazily initialize a collection of role: com.xyz.User.bookmarks, could not initialize proxy - no Session. Trying to access a different endpoint results in RESTEASY008205: JSON Binding serialization error javax.json.bind.JsonbException: Error getting value on: org.hibernate.proxy.pojo.bytebuddy.ByteBuddyInterceptor#2ba18598, by the way, even though I can't figure out the difference between both endpoints.
At this point I'm kind of lost, it all went downhill when I tried to add the filter. Any advice on where I went wrong?
By the way, it's running on jboss-eap-7.2 and I added the following dependency to my POM to access org.codehaus.jackson.annotate.JsonIgnore:
<dependency>
<groupId>org.jboss.resteasy</groupId>
<artifactId>resteasy-jackson-provider</artifactId>
<version>3.6.1.SP2</version>
</dependency>

Answer 1

According to the specification:
When an Application subclass is present in the archive, if both Application.getClasses and Application.getSingletons return an empty collection then all root resource classes and providers packaged in the web application MUST be included and the JAX-RS implementation is REQUIRED to discover them automatically by scanning a .war file as described above. If either getClasses or getSingletons returns a non-empty collection then only those classes or singletons returned MUST be included in the published JAX-RS application.
So once you provide the getClasses override, the automatic discovery is turned off, and you must register explicitely the resources and the providers, including the Jackson features.