--- title: Obfuscating .NET Assemblies That Serialize to JSON and... description: Obfuscating .NET assemblies can silently break JSON and XML serialization because serializers rely on reflection to find property names. Renaming an... canonical: https://daily.dev/posts/obfuscating-net-assemblies-that-serialize-to-json-and-xml-a-practical-field-guide-nithbktpa twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Obfuscating .NET Assemblies That Serialize to JSON and XML: A Practical Field Guide | daily.dev og:description: Obfuscating .NET assemblies can silently break JSON and XML serialization because serializers rely on reflection to find property names. Renaming an... og:url: https://daily.dev/posts/obfuscating-net-assemblies-that-serialize-to-json-and-xml-a-practical-field-guide-nithbktpa og:image: https://api.daily.dev/og/posts/NItHBkTpa.png og:image:alt: Obfuscating .NET Assemblies That Serialize to JSON and XML: A Practical Field Guide og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Obfuscating .NET Assemblies That Serialize to JSON and XML: A Practical Field Guide **[C\# Corner](https://daily.dev/sources/csharpcorner)** · 10 min read · 0 upvotes · 0 comments ## Summary Obfuscating .NET assemblies can silently break JSON and XML serialization because serializers rely on reflection to find property names. Renaming an un-attributed property like TotalAmount to 'a' leaves the serializer looking for a key that no longer exists, so the value stays null with no exception thrown. Properties with explicit attributes like [JsonPropertyName] survive renaming since the serializer reads the attribute string, not the symbol. Polymorphic deserialization is riskier: Newtonsoft's TypeNameHandling.All embeds the assembly-qualified type name in the $type field, breaking across builds unless you add a custom SerializationBinder with stable IDs. The recommended fix is to attribute every serialized property explicitly, or where that is not practical, isolate DTOs in a dedicated namespace excluded from renaming, then test the obfuscated build itself with round-trip, contract fixture, and polymorphic dispatch tests. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why do my JSON properties come back null after obfuscating my .NET assembly? Obfuscation renames the C# property symbol, and System.Text.Json or Newtonsoft.Json falls back to reading that symbol name when no explicit attribute is present. If the renamed symbol (e.g. 'a') doesn't match a key in the incoming payload, the property is left at its default value with no exception thrown, since the serializer treats unmatched fields as optional. _daily.dev surfaces practical fixes like this for teams debugging obfuscation-related serialization bugs._ ### How do I safely obfuscate DTOs that use Newtonsoft.Json TypeNameHandling.All? Implement a custom SerializationBinder that maps stable string IDs to types instead of relying on the assembly-qualified type name written into the $type property. Once the binder is configured on both serialization ends, the $type value becomes a key the binder resolves, so the underlying class and assembly names can be freely renamed by the obfuscator without breaking deserialization. _developers weighing obfuscation tradeoffs for serialization-heavy code can find guides like this on daily.dev._ ### Why does XmlSerializer throw InvalidOperationException after obfuscation? XmlSerializer generates a temporary assembly at runtime built from reflection data, and if a type referenced inside an [XmlInclude] attribute or used for xsi:type gets renamed, the generated serializer looks for a type name that no longer exists. This throws InvalidOperationException during construction, often before any data is even read. _daily.dev helps engineers track down tricky runtime serialization failures like this one._ ## Similar posts on daily.dev - [C\# Reflection Anti-Patterns: 8 Mistakes That Will Hurt Your App](https://daily.dev/posts/c-reflection-anti-patterns-8-mistakes-that-will-hurt-your-app-qr3lftmkf) · We Are .NET · 1 upvotes · 0 comments - [From Fork to Framework: What Modifying Apollo Taught Us…](https://daily.dev/posts/from-fork-to-framework-what-modifying-apollo-taught-us--o6yfppsmm) · Sliver C2 Documentation · 1 upvotes · 0 comments - [Unknown JSON fields in Java REST clients: JSON-B, Jackson, Quarkus, and Spring Boot](https://daily.dev/posts/unknown-json-fields-in-java-rest-clients-json-b-jackson-quarkus-and-spring-boot-eexdgjwha) · Jakarta EE · 3 upvotes · 1 comments - [The pain of serializing unions and closed class hierarchies with System.Text.Json](https://daily.dev/posts/the-pain-of-serializing-unions-and-closed-class-hierarchies-with-system-text-json-5gdr03rjh) · .NET Escapades · 14 upvotes · 1 comments - [Four Malicious NuGet Packages Target ASP.NET Developers With...](https://daily.dev/posts/four-malicious-nuget-packages-target-asp-net-developers-with--57ffqqvc1) · Socket · 2 upvotes · 0 comments --- Tags: [#.net](https://daily.dev/tags/.net) [View this post on daily.dev](https://daily.dev/posts/obfuscating-net-assemblies-that-serialize-to-json-and-xml-a-practical-field-guide-nithbktpa) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Obfuscating .NET Assemblies That Serialize to JSON and XML: A Practical Field Guide","url":"https://daily.dev/posts/obfuscating-net-assemblies-that-serialize-to-json-and-xml-a-practical-field-guide-nithbktpa","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/obfuscating-net-assemblies-that-serialize-to-json-and-xml-a-practical-field-guide-nithbktpa"},"datePublished":"2026-11-09T02:59:29.194Z","dateModified":"2026-11-09T03:02:39.145Z","description":"Obfuscating .NET assemblies can silently break JSON and XML serialization because serializers rely on reflection to find property names. Renaming an...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6a8a1d6914b3c690a725b8fa9423eaf5?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6a8a1d6914b3c690a725b8fa9423eaf5?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"C# Corner","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"C# Corner","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/ada2d584df6241748fc4e71878dc70a3","url":"https://daily.dev/sources/csharpcorner"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/obfuscating-net-assemblies-that-serialize-to-json-and-xml-a-practical-field-guide-nithbktpa","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":".net","timeRequired":"PT10M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"C# Corner","item":"https://daily.dev/sources/csharpcorner"},{"@type":"ListItem","position":3,"name":"Obfuscating .NET Assemblies That Serialize to JSON and XML: A Practical Field Guide"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/obfuscating-net-assemblies-that-serialize-to-json-and-xml-a-practical-field-guide-nithbktpa#faq","mainEntity":[{"@type":"Question","name":"Why do my JSON properties come back null after obfuscating my .NET assembly?","acceptedAnswer":{"@type":"Answer","text":"Obfuscation renames the C# property symbol, and System.Text.Json or Newtonsoft.Json falls back to reading that symbol name when no explicit attribute is present. If the renamed symbol (e.g. 'a') doesn't match a key in the incoming payload, the property is left at its default value with no exception thrown, since the serializer treats unmatched fields as optional. daily.dev surfaces practical fixes like this for teams debugging obfuscation-related serialization bugs."}},{"@type":"Question","name":"How do I safely obfuscate DTOs that use Newtonsoft.Json TypeNameHandling.All?","acceptedAnswer":{"@type":"Answer","text":"Implement a custom SerializationBinder that maps stable string IDs to types instead of relying on the assembly-qualified type name written into the $type property. Once the binder is configured on both serialization ends, the $type value becomes a key the binder resolves, so the underlying class and assembly names can be freely renamed by the obfuscator without breaking deserialization. developers weighing obfuscation tradeoffs for serialization-heavy code can find guides like this on daily.dev."}},{"@type":"Question","name":"Why does XmlSerializer throw InvalidOperationException after obfuscation?","acceptedAnswer":{"@type":"Answer","text":"XmlSerializer generates a temporary assembly at runtime built from reflection data, and if a type referenced inside an [XmlInclude] attribute or used for xsi:type gets renamed, the generated serializer looks for a type name that no longer exists. This throws InvalidOperationException during construction, often before any data is even read. daily.dev helps engineers track down tricky runtime serialization failures like this one."}}]} ```