System.Text.Json fails to serialize JwtBearerOptions in .NET 10 with Events delegates present

[Kali-Sh]

Is there an existing issue for this?

• I have searched the existing issues

Describe the bug

Since we upgraded to .NET 10, the following code throws exception:

System.Text.Json.JsonSerializerOptions serializerOptions = new System.Text.Json.JsonSerializerOptions
{
    PropertyNameCaseInsensitive = true,
    DefaultIgnoreCondition = JsonIgnoreCondition.WhenWritingDefault
};

var singleTestOption = new Microsoft.AspNetCore.Authentication.JwtBearer.JwtBearerOptions();
string optionAsString = System.Text.Json.JsonSerializer.Serialize(singleTestOption, serializerOptions); // <-- throws exception

In .NET 9 the above code did NOT throw exception and successfully serialized.

Expected Behavior

No response

Steps To Reproduce

No response

Exceptions (if any)

System.NotSupportedException: Serialization and deserialization of 'System.Func2[[Microsoft.AspNetCore.Authentication.JwtBearer.AuthenticationFailedContext, Microsoft.AspNetCore.Authentication.JwtBearer, Version=10.0.0.0, Culture=neutral, PublicKeyToken=adb9793829ddae60],[System.Threading.Tasks.Task, System.Private.CoreLib, Version=10.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e]]' instances is not supported. The unsupported member type is located on type 'System.Func2[Microsoft.AspNetCore.Authentication.JwtBearer.AuthenticationFailedContext,System.Threading.Tasks.Task]'. Path: $.Events.OnAuthenticationFailed.
---> System.NotSupportedException: Serialization and deserialization of 'System.Func2[[Microsoft.AspNetCore.Authentication.JwtBearer.AuthenticationFailedContext, Microsoft.AspNetCore.Authentication.JwtBearer, Version=10.0.0.0, Culture=neutral, PublicKeyToken=adb9793829ddae60],[System.Threading.Tasks.Task, System.Private.CoreLib, Version=10.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e]]' instances is not supported. at System.Text.Json.Serialization.Converters.UnsupportedTypeConverter1.Write(Utf8JsonWriter writer, T value, JsonSerializerOptions options)
at System.Text.Json.Serialization.JsonConverter1.TryWrite(Utf8JsonWriter writer, T& value, JsonSerializerOptions options, WriteStack& state) at System.Text.Json.Serialization.Metadata.JsonPropertyInfo1.GetMemberAndWriteJson(Object obj, WriteStack& state, Utf8JsonWriter writer)
at System.Text.Json.Serialization.Converters.ObjectDefaultConverter1.OnTryWrite(Utf8JsonWriter writer, T value, JsonSerializerOptions options, WriteStack& state) at System.Text.Json.Serialization.JsonConverter1.TryWrite(Utf8JsonWriter writer, T& value, JsonSerializerOptions options, WriteStack& state)
at System.Text.Json.Serialization.Metadata.JsonPropertyInfo1.GetMemberAndWriteJson(Object obj, WriteStack& state, Utf8JsonWriter writer) at System.Text.Json.Serialization.Converters.ObjectDefaultConverter1.OnTryWrite(Utf8JsonWriter writer, T value, JsonSerializerOptions options, WriteStack& state)
at System.Text.Json.Serialization.JsonConverter1.TryWrite(Utf8JsonWriter writer, T& value, JsonSerializerOptions options, WriteStack& state) at System.Text.Json.Serialization.JsonConverter1.WriteCore(Utf8JsonWriter writer, T& value, JsonSerializerOptions options, WriteStack& state)
--- End of inner exception stack trace ---
at System.Text.Json.ThrowHelper.ThrowNotSupportedException(WriteStack& state, Exception innerException)
at System.Text.Json.Serialization.JsonConverter1.WriteCore(Utf8JsonWriter writer, T& value, JsonSerializerOptions options, WriteStack& state) at System.Text.Json.Serialization.Metadata.JsonTypeInfo1.Serialize(Utf8JsonWriter writer, T& rootValue, Object rootValueBoxed)
at System.Text.Json.JsonSerializer.WriteString[TValue](TValue& value, JsonTypeInfo`1 jsonTypeInfo)
at System.Text.Json.JsonSerializer.Serialize[TValue](TValue value, JsonSerializerOptions options)
at Test.Service.Worker.ExecuteAsync(CancellationToken stoppingToken)

.NET Version

10.0.100-rc.2.25502.107

Anything else?

No response

[nithyav2017]

I was able to reproduce this in both .NET 9 and .NET 10 preview. The issue occurs only when as Event delegate is assigned, since the delegates work only during runtime and it can not be serialized by System.Text.Json.

var singletonOption = new Microsoft.AspNetCore.Authentication.JwtBearer.JwtBearerOptions
{
    Events = new Microsoft.AspNetCore.Authentication.JwtBearer.JwtBearerEvents
    {
        OnAuthenticationFailed = context =>
        {
            Console.WriteLine("Authentication failed: " + context.Exception.Message);
            return System.Threading.Tasks.Task.CompletedTask;
        }
    }
};

As a workaround , I created DTO that excludes Events property and mapped only the serializable members manually . I continue to use Event delegates for runtime behavior for example, handling token validation failure, but avoid serializing the full JwtBearerOptions object. This prevents the NotSupportedException while preserving expected runtime behavior.

 public class JwtBearerOptionsDto
 { 
     public bool RequireHttpsMetadata { get; set; }
 
     public TokenValidationParameters TokenvalidationParameters { get; set; }
 }


  var jwtOptions = new JwtBearerOptions
{     
    RequireHttpsMetadata = true,
    SaveToken = true,
    Events = new JwtBearerEvents
    {
        OnAuthenticationFailed = context =>
        {
            Console.WriteLine("Token validation failed");
            return Task.CompletedTask;
        }
    }
};



static JwtBearerOptionsDto ToDto(JwtBearerOptions options)
{
    return new JwtBearerOptionsDto
    { 
        RequireHttpsMetadata = options.RequireHttpsMetadata,

        // excluded Authority and Audience for example purposes of serialization
        TokenvalidationParameters = new TokenValidationParameters
        {
            ValidateIssuer = options.TokenValidationParameters.ValidateIssuer,
            ValidateAudience = options.TokenValidationParameters.ValidateAudience,
          
        }
    };
}
var options= ToDto(jwtOptions);
var json = JsonSerializer.Serialize(options);
Console.WriteLine(json);
Console.ReadLine();  

Let me know If any refinements would be helpful.

[Kali-Sh]

You are able to reproduce this in .net 9 ONLY if the delegate is assigned.
If it is not, it is ignored by the serializator and you are able to serialize successfully, like this:

System.Text.Json.JsonSerializerOptions serializerOptions = new System.Text.Json.JsonSerializerOptions
{
    PropertyNameCaseInsensitive = true,
    DefaultIgnoreCondition = JsonIgnoreCondition.WhenWritingDefault
};

var singleTestOption = new Microsoft.AspNetCore.Authentication.JwtBearer.JwtBearerOptions();
string optionAsString = System.Text.Json.JsonSerializer.Serialize(singleTestOption, serializerOptions); // <-- throws exception in .net 10; is serialized in .net 9

With your example:

var singletonOption = new Microsoft.AspNetCore.Authentication.JwtBearer.JwtBearerOptions
{
    Events = new Microsoft.AspNetCore.Authentication.JwtBearer.JwtBearerEvents
    {
        OnAuthenticationFailed = context =>
        {
            Console.WriteLine("Authentication failed: " + context.Exception.Message);
            return System.Threading.Tasks.Task.CompletedTask;
        }
    }
};

It always throws exception in both versions (because there is assigned delegate).

Is the serializator intended to work this way, when NOT having assigned delegates?
Because this is a change from previous behavior

[nithyav2017]

I tested the below code in .NET 8,9, 10 RC2(10.0.100-rc.2.25502.107).

var singletonOption = new Microsoft.AspNetCore.Authentication.JwtBearer.JwtBearerOptions
{
    Events = new Microsoft.AspNetCore.Authentication.JwtBearer.JwtBearerEvents
    {
        OnAuthenticationFailed = context =>
        {
            Console.WriteLine("Authentication failed: " + context.Exception.Message);
            return System.Threading.Tasks.Task.CompletedTask;
        }
    }
};

System.Text.Json.JsonSerializerOptions options = new()
{
    PropertyNameCaseInsensitive = true,
    DefaultIgnoreCondition = System.Text.Json.Serialization.JsonIgnoreCondition.WhenWritingDefault
};
 string optionAsString = System.Text.Json.JsonSerializer.Serialize(singletonOption, options);

When the delegate is assigned (OnAuthenticationFailed ) , serialization throws NotSupportedException in all versions.

When the delegate is not assigned or null (Events = null) , serialization succeeds.

.NET 8,9,10 RC2 work consistently across the versions.

[blowdart]

I'm curious what you're trying to achieve here.

You can't set events/delegates when reading from json, because they're code, not text. You're asking for binaryformatter like state in something that is not mean for that, and that's why it fails.

In normal use you wire up the options via the options pattern and then wire up the events after. What's your use case for trying to serialize to json within your own code?

[MackinnonBuck]

We would suggest the workaround suggested by @nithyav2017, which is to create a separate type which contains only the JSON-serializable properties you care about. We generally don't guarantee that "options" types are JSON-serializable, so we wouldn't consider this a bug.

We're going to close out this issue as "not planned'.

[Kali-Sh]

I have already used the suggested approach, it is no issue.
I just noticed the change in behavior, this is why I opened this ticket.