Duplicate object keys handling change with Jackson 2.13 FAIL_ON_READING_DUP_TREE_KEY

Transitioning Jackson 2.12 to 2.13+

To move from Jackson 2.12 to 2.13+ without breaking existing payloads, you must explicitly maintain the "last-wins" behavior. By default, FAIL_ON_READING_DUP_TREE_KEY is disabled, but if your organization is moving toward strict validation, do not enable this feature globally until all upstream producers are audited.

Recommended Configuration Path

1. Maintain Compatibility: Ensure the JsonParser.Feature.STRICT_DUPLICATE_DETECTION (or the mapper-level FAIL_ON_READING_DUP_TREE_KEY) remains false during the initial upgrade.
2. Gradual Enforcement: Enable the feature only on specific ObjectMapper instances used for new, strictly-governed APIs.
3. Verification: Test your current payloads with the feature enabled in a staging environment to identify which services are sending duplicate keys before enforcing the change in production.

Detecting Duplicates in Non-Supporting Environments

Since Gson, Node.js JSON.parse(), and Python's json module default to last-wins without native detection toggles, you must implement a custom interception layer. The most reliable method is to use a streaming parser or a custom object hook.

• Python: Use the object_pairs_hook argument in json.loads(). This passes a list of tuples instead of a dictionary, allowing you to check for duplicate keys manually.
• Node.js: Use a library like json-source-map or a custom parser that implements a reviver function, though native JSON.parse cannot detect duplicates once the object is constructed.
• General Approach: Parse the input into a raw tree/token stream and maintain a set of keys for the current object scope; if a key is already present in the set, trigger a validation error.

Consistency and Schema Violations

Duplicate keys should be treated as a schema violation if the data is used for security-critical operations (e.g., authentication claims or financial totals) to prevent "JSON Injection" or "Parameter Pollution" attacks where different parsers see different values.

Assumption: This guidance assumes the use of standard ObjectMapper configurations. If using custom Deserializers, the FAIL_ON_READING_DUP_TREE_KEY feature may not automatically trigger unless the deserializer relies on the underlying tree model.

Verification Command (Jackson 2.13+)

// Java snippet to verify strict detection
ObjectMapper mapper = JsonMapper.builder()
    .enable(JsonParser.Feature.STRICT_DUPLICATE_DETECTION)
    .build();
// This will throw JsonProcessingException if duplicates exist
mapper.readTree("{\"key\": 1, \"key\": 2}");