FasterXML/jackson-databind · error · IllegalArgumentException

Cannot use includeAs of {} for Default Typing

Error message

Cannot use includeAs of {} for Default Typing

What it means

Thrown by MapperBuilder.activateDefaultTyping when the requested JsonTypeInfo.As is EXTERNAL_PROPERTY. External-property inclusion is fundamentally incompatible with global default typing because it needs per-property decisions the global resolver cannot make, so the builder rejects it explicitly instead of failing silently at (de)serialization time.

Source

Thrown at src/main/java/tools/jackson/databind/cfg/MapperBuilder.java:1785

     * and attempts of do so will throw an {@link IllegalArgumentException} to make
     * this limitation explicit.
     *<p>
     * NOTE: choice of {@link PolymorphicTypeValidator} to configure is of
     * crucial importance to security when deserializing untrusted content:
     * this because allowing deserializing of any type can lead to malicious
     * attacks using "deserialization gadgets". Implementations should use
     * allow-listing to specify acceptable types unless source of content
     * is fully trusted to only send safe types.
     *
     * @param applicability Defines kinds of types for which additional type information
     *    is added; see {@link DefaultTyping} for more information.
     */
    public B activateDefaultTyping(PolymorphicTypeValidator subtypeValidator,
            DefaultTyping applicability, JsonTypeInfo.As includeAs)
    {
        // Use if "As.EXTERNAL_PROPERTY" will not work, check to ensure no attempts made
        if (includeAs == JsonTypeInfo.As.EXTERNAL_PROPERTY) {
            throw new IllegalArgumentException("Cannot use includeAs of "+includeAs+" for Default Typing");
        }
        return setDefaultTyping(_defaultDefaultTypingResolver(subtypeValidator,
                applicability, includeAs));
    }

    /**
     * Method for enabling automatic inclusion of type information -- needed
     * for proper deserialization of polymorphic types (unless types
     * have been annotated with {@link com.fasterxml.jackson.annotation.JsonTypeInfo}) --
     * using "As.PROPERTY" inclusion mechanism and specified property name
     * to use for inclusion (default being "@class" since default type information
     * always uses class name as type identifier)
     *<p>
     * NOTE: choice of {@link PolymorphicTypeValidator} to configure is of
     * crucial importance to security when deserializing untrusted content:
     * this because allowing deserializing of any type can lead to malicious
     * attacks using "deserialization gadgets". Implementations should use
     * allow-listing to specify acceptable types unless source of content

View on GitHub (pinned to a50c7d2a1d)

Solutions

  1. Use a supported inclusion for default typing: JsonTypeInfo.As.PROPERTY, WRAPPER_ARRAY, or WRAPPER_OBJECT.
  2. If you genuinely need EXTERNAL_PROPERTY semantics, apply @JsonTypeInfo per-type/per-property instead of enabling global default typing.
  3. Use activateDefaultTypingAsProperty(validator, applicability, propertyName) which selects PROPERTY for you.

Example fix

// before
builder.activateDefaultTyping(ptv, DefaultTyping.NON_FINAL,
        JsonTypeInfo.As.EXTERNAL_PROPERTY); // throws
// after
builder.activateDefaultTyping(ptv, DefaultTyping.NON_FINAL,
        JsonTypeInfo.As.PROPERTY);
Defensive patterns

Strategy: validation

Validate before calling

JsonTypeInfo.As includeAs = resolveIncludeAs();
if (includeAs == JsonTypeInfo.As.EXTERNAL_PROPERTY) {
    throw new IllegalArgumentException(
        "EXTERNAL_PROPERTY is not supported for default typing; use per-type @JsonTypeInfo");
}
builder.activateDefaultTyping(ptv, applicability, includeAs);

Prevention

When it happens

Trigger: Calling mapperBuilder.activateDefaultTyping(validator, applicability, JsonTypeInfo.As.EXTERNAL_PROPERTY).

Common situations: Porting per-type @JsonTypeInfo(include = As.EXTERNAL_PROPERTY) code and assuming the same mode works globally; copy-pasting an As constant without checking which are permitted for default typing; AI/autocomplete picking the wrong enum value.

Related errors


AI-assisted analysis of FasterXML/jackson-databind@a50c7d2a1d (2026-08-06). Data as JSON: /api/errors/3f403428c70655de. Report an issue: GitHub.