Page History

Object serialization is the process of saving Once an object 's state as a sequence of bytes; deserialization is the process of rebuilding the object from those bytes. The primary application of serialization is in Java Remote Method Invocation (RMI) wherein objects are packed (marshalled), exchanged between distributed virtual machines, and unpacked (unmarshalled). It also finds extensive use in Java Beans.Once a serializable a particular class has been exportedserialized, future refactoring of its the class's code often becomes problematic. Specifically, existing serialized forms (encoded representations) become part of the object's published API and must be supported for an indefinite period. This can be troublesome from a security perspective; not only does it promote dead code, it can also commit forces the provider to maintain a compatible code base for the life of their products.

Classes that implement Serializable and fail to do not override its functionality are said to be using the default serialized form. In the event of future changes to the class, byte streams produced by users of old versions of the class will be incompatible with the new implementation. Programs must maintain serialization compatibility during class evolution. An acceptable approach is the use of a custom serialized form, which relieves the implementer of the necessity to maintain the original serialized form and the corresponding version of the class in addition to the newly evolved version.

...

...