From 88ea668f47515ecbbb9406c68c813589f1795a34 Mon Sep 17 00:00:00 2001
From: Ziqin Wang <ziqin@wangziqin.net>
Date: Sun, 15 Mar 2026 12:27:41 +0800
Subject: [PATCH] Test Jackson 2 deserializer with unknown obj/arr WebAuthn ext

Signed-off-by: Ziqin Wang <ziqin@wangziqin.net>
---
 .../web/webauthn/jackson/JacksonTests.java    | 24 +++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/web/src/test/java/org/springframework/security/web/webauthn/jackson/JacksonTests.java b/web/src/test/java/org/springframework/security/web/webauthn/jackson/JacksonTests.java
index ba970125e0..d214c4dd2c 100644
--- a/web/src/test/java/org/springframework/security/web/webauthn/jackson/JacksonTests.java
+++ b/web/src/test/java/org/springframework/security/web/webauthn/jackson/JacksonTests.java
@@ -122,6 +122,30 @@ class JacksonTests {
 		assertThat(outputs).usingRecursiveComparison().isEqualTo(credProps);
 	}
 
+	@Test
+	void readAuthenticationExtensionsClientOutputsWhenUnknownExtension() throws Exception {
+		String json = """
+				{
+				  "unknownObject1": {
+				    "key": "value"
+				  },
+				  "unknownArray": [
+				    { "key": "value1" },
+				    { "key": "value2" }
+				  ],
+				  "credProps": {
+				    "rk": false
+				  },
+				  "unknownObject2": {}
+				}
+				""";
+		CredentialPropertiesOutput credProps = new CredentialPropertiesOutput(false);
+
+		AuthenticationExtensionsClientOutputs outputs = this.mapper.readValue(json,
+				AuthenticationExtensionsClientOutputs.class);
+		assertThat(outputs.getOutputs()).usingRecursiveFieldByFieldElementComparator().contains(credProps);
+	}
+
 	@Test
 	void readAuthenticationExtensionsClientOutputsWhenFieldAfter() throws Exception {
 		String json = """