JSON Debugging

JSON Duplicate Keys Guide

Detect duplicate JSON object keys and prevent silent last-value wins across parsers, configuration files and signed payloads. Last updated September 30, 2026.

Detect duplicate JSON object keys and prevent silent last-value wins across parsers, configuration files and signed payloads. This reference is written for developers who need practical validation behavior, reviewable rules and safe examples rather than copied snippets with no explanation.

Recommended workflow

Step	Why it matters
Preserve source text	Duplicate keys disappear after many parsers convert input to an object.
Use duplicate-aware parsing	Reject repeated member names during tokenization or linting.
Compare consumers	Gateways, signature code and applications may choose first, last or error behavior.
Fix generation	Build objects structurally and validate configuration merges before serialization.

Starter snippet

{"role":"user","role":"admin"}  // ambiguous and unsafe

Review checks

Reject duplicates at trust boundaries.
Test nested objects too.
Canonicalize only after validation.
Document merge semantics outside JSON syntax.

Common mistakes

Checking duplicates after JSON.parse.
Assuming every parser keeps the last value.
Signing one interpretation and authorizing another.

Validation should help users correct input while protecting systems from bad data. Keep syntax checks, product policy, security review and deliverability checks separate.

Related Formalint references

Continue with JSON Lint Error, API HMAC Request Signing, Config File Validation.