基于SpringBoot+Jackson实现注解式字段脱敏方案

package com.example.desensitize.enums;
/**
 * 脱敏类型枚举
 */
public enum DesensitizeType {
    /** 手机号 */
    PHONE,
    /** 身份证号 */
    ID_CARD,
    /** 邮箱 */
    EMAIL,
    /** 姓名 */
    NAME,
    /** 地址 */
    ADDRESS,
    /** 自定义兜底 */
    CUSTOM
}

package com.example.desensitize.annotation;
import com.example.desensitize.enums.DesensitizeType;
import com.fasterxml.jackson.annotation.JacksonAnnotationsInside;
import java.lang.annotation.ElementType;
import java.lang.annotation.Retention;
import java.lang.annotation.RetentionPolicy;
import java.lang.annotation.Target;
/**
 * 字段脱敏注解
 */
@Target(ElementType.FIELD)
@Retention(RetentionPolicy.RUNTIME)
@JacksonAnnotationsInside
public @interface Desensitize {
    /**
     * 脱敏类型
     */
    DesensitizeType type();
}

package com.example.desensitize.serializer;
import com.example.desensitize.enums.DesensitizeType;
import com.fasterxml.jackson.core.JsonGenerator;
import com.fasterxml.jackson.databind.JsonSerializer;
import com.fasterxml.jackson.databind.SerializerProvider;
import java.io.IOException;
/**
 * 自定义脱敏序列化器
 * 泛型限定为 String，仅字符串字段会触发
 */
public class DesensitizeSerializer extends JsonSerializer<String> {
    private final DesensitizeType desensitizeType;
    public DesensitizeSerializer(DesensitizeType desensitizeType) {
        this.desensitizeType = desensitizeType;
    }
    @Override
    public void serialize(String value, JsonGenerator gen, SerializerProvider serializers) throws IOException {
        // null 值直接输出 null，不进入脱敏逻辑
        if (value == null) {
            gen.writeNull();
            return;
        }
        // 执行脱敏并写入结果
        gen.writeString(doDesensitize(value, desensitizeType));
    }
    /**
     * JDK17 switch 表达式实现脱敏逻辑
     * 优势：无 break、无穿透风险，支持代码块内多逻辑，直接返回结果
     */
    private String doDesensitize(String value, DesensitizeType type) {
        return switch (type) {
            case PHONE -> {
                // 手机号：11位，保留前3后4，中间4位打码
                if (value.length() != 11) yield value;
                yield value.replaceAll("(\\d{3})\\d{4}(\\d{4})", "$1****$2");
            }
            case ID_CARD -> {
                // 身份证：18位，保留前6后4，中间8位打码
                if (value.length() != 18) yield value;
                yield value.replaceAll("(\\d{6})\\d{8}(\\d{4})", "$1********$2");
            }
            case EMAIL -> {
                // 邮箱：保留 @ 前首字符，其余打码
                int atIndex = value.indexOf("@");
                if (atIndex <= 1) yield value;
                yield value.charAt(0) + "****" + value.substring(atIndex);
            }
            case NAME -> {
                // 姓名：保留首字，其余字符打码
                if (value.isEmpty()) yield value;
                yield value.charAt(0) + "*".repeat(Math.max(0, value.length() - 1));
            }
            case ADDRESS -> {
                // 地址：保留前6位，后续打码
                if (value.length() <= 6) yield value;
                yield value.substring(0, 6) + "****";
            }
            // 未知类型原样返回
            default -> value;
        };
    }
}

package com.example.desensitize.introspector;
import com.example.desensitize.annotation.Desensitize;
import com.example.desensitize.serializer.DesensitizeSerializer;
import com.fasterxml.jackson.databind.AnnotationIntrospector;
import com.fasterxml.jackson.databind.introspect.Annotated;
import com.fasterxml.jackson.databind.introspect.JacksonAnnotationIntrospector;
/**
 * 脱敏注解内省器
 * 负责将 @Desensitize 注解与自定义序列化器进行绑定
 */
public class DesensitizeAnnotationIntrospector extends JacksonAnnotationIntrospector {
    @Override
    public Object findSerializer(Annotated annotated) {
        // 获取字段上的脱敏注解
        Desensitize desensitize = annotated.getAnnotation(Desensitize.class);
        // 仅当注解存在且字段类型为 String 时，返回自定义序列化器
        if (desensitize != null && annotated.getRawType() == String.class) {
            return new DesensitizeSerializer(desensitize.type());
        }
        // 无注解则走默认逻辑
        return super.findSerializer(annotated);
    }
}

package com.example.desensitize.config;
import com.example.desensitize.introspector.DesensitizeAnnotationIntrospector;
import com.fasterxml.jackson.databind.module.SimpleModule;
import org.springframework.boot.autoconfigure.jackson.Jackson2ObjectMapperBuilderCustomizer;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
/**
 * Jackson 脱敏自动配置
 */
@Configuration
public class JacksonDesensitizeConfig {
    @Bean
    public Jackson2ObjectMapperBuilderCustomizer desensitizeCustomizer() {
        return builder -> {
            // 1. 创建自定义模块
            SimpleModule desensitizeModule = new SimpleModule("DesensitizeModule");
            // 2. 注册注解内省器（序列化、反序列化均设置，脱敏仅在序列化阶段生效）
            desensitizeModule.setAnnotationIntrospectors(
                    new DesensitizeAnnotationIntrospector(),
                    new DesensitizeAnnotationIntrospector()
            );
            // 3. 将模块注册到 ObjectMapper
            builder.modules(desensitizeModule);
        };
    }
}

package com.example.desensitize.vo;
import com.example.desensitize.annotation.Desensitize;
import com.example.desensitize.enums.DesensitizeType;
import lombok.Data;
@Data
public class UserVO {
    private Long userId;
    @Desensitize(type = DesensitizeType.NAME)
    private String userName;
    @Desensitize(type = DesensitizeType.PHONE)
    private String phone;
    @Desensitize(type = DesensitizeType.ID_CARD)
    private String idCard;
    @Desensitize(type = DesensitizeType.EMAIL)
    private String email;
    @Desensitize(type = DesensitizeType.ADDRESS)
    private String address;
    // 普通字段，不受脱敏影响
    private Integer age;
}

package com.example.desensitize.controller;
import com.example.desensitize.vo.UserVO;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;
@RestController
@RequestMapping("/api/user")
public class UserController {
    @GetMapping("/info")
    public UserVO getUserInfo() {
        UserVO user = new UserVO();
        user.setUserId(1001L);
        user.setUserName("张三丰");
        user.setPhone("13812345678");
        user.setIdCard("110101199001011234");
        user.setEmail("zhangsan@example.com");
        user.setAddress("北京市朝阳区建国路88号");
        user.setAge(30);
        return user;
    }
}

{
  "userId": 1001,
  "userName": "张**",
  "phone": "138****5678",
  "idCard": "110101********1234",
  "email": "z****@example.com",
  "address": "北京市朝阳区****",
  "age": 30
}