Omit "_core" key from normalized config entities, which includes the default config hash

We should ensure that once we open PATCH/POST requests that we cannot override the values. Does that mean we should exclude them in denormalization here already?

+++ b/core/modules/serialization/src/Normalizer/ConfigEntityNormalizer.php
@@ -18,7 +18,15 @@ class ConfigEntityNormalizer extends EntityNormalizer {
   public function normalize($object, $format = NULL, array $context = []) {
-    return $object->toArray();
+    return array_diff_key($object->toArray(), ['_core' => TRUE]);
+  }
...
+  public function denormalize($data, $class, $format = NULL, array $context = []) {
+    unset($data['_core']);
+    return parent::denormalize($data, $class, $format, $context);

Should we explain why we skip core here? Also: Why do we use once array_diff_key and once unset() ... can't we use the same approach here twice?

WFM

Updating review credits

+++ b/core/modules/serialization/src/Normalizer/ConfigEntityNormalizer.php
@@ -18,7 +18,33 @@ class ConfigEntityNormalizer extends EntityNormalizer {
+    return static::getDataWithoutInternals($object->toArray());
...
+    return parent::denormalize(static::getDataWithoutInternals($data), $class, $format, $context);

Any reason we went for static here?

+++ b/core/modules/rest/tests/src/Functional/EntityResource/ConfigurableLanguage/ConfigurableLanguageResourceTestBase.php
@@ -74,4 +75,21 @@ protected function getNormalizedPostEntity() {
+    $normalization = $this->serializer->decode((string) $response->getBody(), static::$format);
+    $this->assertArrayNotHasKey('_core', $normalization);

This is only a negative assertion which makes me think that the test might be a bit brittle. I was wondering about why we have this test - but it is the only non-unit test case of the change. It does mean if we remove the configurable language we'd suddenly lose this test coverage.

Committed as 96452be and pushed to 8.5.x.