Serialization is the process of converting an object into a sequence of bytes so that it can be transmitted over a network or stored in a flat file and recreated later.
A serialized object includes:
Object data
Object type
Types of data stored within the object
What is the main purpose of serialization in Java?
The primary uses of serialization are:
Persistence: We can write data to a file or database to be used later via deserialization.
Communication: To pass objects over a network using Remote Procedure Calls (RPC).
Copying: To create deep copies or duplicates of original objects using byte arrays.
Distribution: To distribute objects across different JVMs.
What are alternatives to Java serialization?
Common alternatives include:
XML-based data transfer: Using libraries like JIBX or JAXB to marshal an object’s data to XML, transfer it, and then unmarshal it back into an object.
JSON-based data transfer: Converting objects to JSON format using libraries like Jackson, Gson, or JSON-B for lightweight, language-agnostic data transfer.
Explain the Serializable interface in Java.
java.io.Serializable is a marker interface defined in the java.io package and contains no methods.
Implementing Serializable lets the JVM know that instances of the class are eligible for serialization.
public interface Serializable { // No methods to implement}
How do you make an object serializable in Java?
Ensure your class implements the Serializable interface.
Ensure all member objects referenced inside your class also implement Serializable (otherwise, a NotSerializableException will be thrown).
Use ObjectOutputStream (which extends OutputStream) to write objects to a stream.
Use ObjectInputStream (which extends InputStream) to read objects back from the stream.
What is serialVersionUID and why is it important?
serialVersionUID is a 64-bit long unique identifier that acts as a hash code of the class name, super interfaces, and members. No two classes share the same SUID.
When an object is serialized, its SUID is serialized along with it.
During deserialization, the JVM compares the stream’s SUID with the loaded class’s SUID. If they do not match, Java throws an InvalidClassException.
What happens if we don't explicitly define serialVersionUID?
If not explicitly defined, the JVM automatically computes and generates one at runtime based on the class’s properties.
Drawbacks: Letting the JVM compute it at runtime is computationally expensive and impacts performance. Furthermore, any minor change to the class structure can alter the generated hash, breaking previously serialized objects.
Best Practice: Always declare it explicitly:
private static final long serialVersionUID = -5885568094444284875L;
Can we serialize static variables in Java?
No. Static variables belong to the class rather than a specific object instance. Serialization is designed to save the state of an object, not the state of a class.
Note:serialVersionUID is a static field, but it is treated as a special exception and gets serialized along with the object stream.
When we serialize an object, does the serialization mechanism save its references too?
Yes. If an object references other objects, those referenced objects must also implement Serializable.
If any referenced object fails to implement Serializable, Java throws a NotSerializableException at runtime.
How can you prevent specific fields from being serialized?
You can declare those specific variables using the transient keyword.
During deserialization, transient variables are initialized with their default values (e.g., 0 for numeric primitives, false for booleans, and null for object references).
What is Externalization in Java, and how does it differ from Serialization?
Externalization (java.io.Externalizable) gives the developer complete control over the serialization process by implementing writeExternal() and readExternal() methods.
Unlike Serializable (which uses default automatic reflection-based serialization), Externalizable requires manual writing and reading of every field, which can significantly improve performance and reduce payload size.
What are the security risks associated with Java serialization?
Native Java serialization is notoriously vulnerable to Remote Code Execution (RCE) attacks via “deserialization vulnerabilities” if untrusted data is passed into ObjectInputStream.readObject().
Attackers can manipulate byte streams to execute arbitrary code. Because of these risks, modern frameworks often favor safer data formats like JSON or XML, or implement strict class-filtering deserialization look-aheads.