diff --git a/core/src/main/java/org/springframework/security/jackson2/UserDeserializer.java b/core/src/main/java/org/springframework/security/jackson2/UserDeserializer.java index 0407214b7a..db451a6cbd 100644 --- a/core/src/main/java/org/springframework/security/jackson2/UserDeserializer.java +++ b/core/src/main/java/org/springframework/security/jackson2/UserDeserializer.java @@ -65,7 +65,7 @@ class UserDeserializer extends JsonDeserializer { readJsonNode(jsonNode, "credentialsNonExpired").asBoolean(), readJsonNode(jsonNode, "accountNonLocked").asBoolean(), authorities ); - + if(password.asText(null) == null) { result.eraseCredentials(); }