Skip to content

Consider not including fields in default Workflow serialization #1582

@frankbuckley

Description

@frankbuckley

When using Workflow, the default JSON serializer is configured to include fields by default.

public class JsonDataConverter : DataConverter
{
    // WARNING: Changing default serialization options could potentially be breaking for in-flight orchestrations.
    static readonly JsonSerializerOptions DefaultOptions = new()
    {
        IncludeFields = true,
    };

This is unusual as it is not the default in .NET and might lead to unexpected data leaks/disclosure.

Changing the default is a breaking change for existing workflows, but it seems unlikely that users are relying on this unusual behaviour. If anyone is then the configuration can be overridden.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions