Working with Serialization
1. Implementing Serializable Interface
Example: Serializable
public class User implements Serializable {
private static final long serialVersionUID = 1L ;
private String name;
private transient String password; // not serialized
}
Aspect Detail
Marker interface No methods
Required field serialVersionUID recommended
Excluded fields transient and static
2. Using ObjectOutputStream
Method Use
writeObject(o)Serialize object graph
writeInt/Double/UTFPrimitive writes
flush() / close()Resource management
Example: Read object
try (ObjectInputStream in = new ObjectInputStream (Files. newInputStream (path))) {
User u = (User) in. readObject ();
}
Method Use
readObject()Returns Object — cast required
Throws ClassNotFoundException, InvalidClassException
4. Understanding serialVersionUID
Aspect Detail
Purpose Version identifier for class
Mismatch Throws InvalidClassException
Auto-computed Based on class structure (fragile)
Recommendation Always declare explicitly
5. Using transient Keyword
Effect Detail
Skip serialization Field not written
On deserialization Field gets default value (0/null/false)
Use for Passwords, caches, computed fields
6. Customizing Serialization
Example: Custom serialization
private void writeObject (ObjectOutputStream out) throws IOException {
out. defaultWriteObject ();
out. writeInt (computedValue);
}
private void readObject (ObjectInputStream in) throws IOException, ClassNotFoundException {
in. defaultReadObject ();
this .computedValue = in. readInt ();
}
private Object readResolve () { return Singleton.INSTANCE; }
Hook Use
writeObject/readObjectCustom format
readResolveReplace deserialized object (singletons)
writeReplaceSubstitute before write
7. Implementing Externalizable Interface
Aspect Detail
Methods writeExternal/readExternal
Constructor Must have public no-arg
Use case Full control over format (rare)
8. Understanding Serialization Security Concerns
Risk Detail
Deserialization attacks Hostile streams can execute arbitrary code via gadget chains
Mitigation Use ObjectInputFilter to whitelist classes
Modern alternative JSON/Protobuf/Avro/CBOR
Warning: Java serialization is widely considered legacy. Prefer JSON/Protobuf for new code.
9. Handling Versioning Issues
Compatible Change Incompatible Change
Add field (default value used) Change field type
Add method Remove field (with old data)
Make non-final Move class to different package
10. Using Serialization Proxy Pattern
Step Detail
1. Inner proxy class Holds simplified state
2. writeReplace() Returns proxy instead of self
3. readResolve() Reconstruct from proxy
4. Block direct deserialization readObject throws