Explain like i'm five - what is Serializable?
java - When should we implement Serializable interface? - Stack Overflow
serialization - What is Serializable in Java? - Stack Overflow
Serializable What does it acutally do ?
What happens if a class does not implement the Serializable interface in Java, but serialization is attempted?
Can you serialize objects that contain references to non-serializable classes?
Can static fields be serialized in Java?
Videos
I just don't get it. I'm a junior and see it often in the codebase of the company i work at. Documentation says that it helps serialize and deserialize objects, but why does that need to happen using this interface? There are so many classes that do not implement Serializable, so what happens to them?
Head First Java book says that objects need to be serialized when data is sent over the network or saved to a disk. But there is serialization/deserialization happening to JSON objects for example when they're being sent from server to client and vice versa, and those classes do not implement Serializable.
So in which "special" scenario does one need/want to implement Serializable?
From What's this "serialization" thing all about?:
It lets you take an object or group of objects, put them on a disk or send them through a wire or wireless transport mechanism, then later, perhaps on another computer, reverse the process: resurrect the original object(s). The basic mechanisms are to flatten object(s) into a one-dimensional stream of bits, and to turn that stream of bits back into the original object(s).
Like the Transporter on Star Trek, it's all about taking something complicated and turning it into a flat sequence of 1s and 0s, then taking that sequence of 1s and 0s (possibly at another place, possibly at another time) and reconstructing the original complicated "something."
So, implement the
Serializableinterface when you need to store a copy of the object, send them to another process which runs on the same system or over the network.Because you want to store or send an object.
It makes storing and sending objects easy. It has nothing to do with security.
The answer to this question is, perhaps surprisingly, never, or more realistically, only when you are forced to for interoperability with legacy code. This is the recommendation in Effective Java, 3rd Edition by Joshua Bloch:
There is no reason to use Java serialization in any new system you write
Oracle's chief architect, Mark Reinhold, is on record as saying removing the current Java serialization mechanism is a long-term goal.
Why Java serialization is flawed
Java provides as part of the language a serialization scheme you can opt in to, by using the Serializable interface. This scheme however has several intractable flaws and should be treated as a failed experiment by the Java language designers.
- It fundamentally pretends that one can talk about the serialized form of an object. But there are infinitely many serialization schemes, resulting in infinitely many serialized forms. By imposing one scheme, without any way of changing the scheme, applications can not use a scheme most appropriate for them.
- It is implemented as an additional means of constructing objects, which bypasses any precondition checks your constructors or factory methods perform. Unless tricky, error prone, and difficult to test extra deserialization code is written, your code probably has a gaping security weakness.
- Testing interoperability of different versions of the serialized form is very difficult.
- Handling of immutable objects is troublesome.
What to do instead
Instead, use a serialization scheme that you can explicitly control. Such as Protocol Buffers, JSON, XML, or your own custom scheme.
serializable is a special interface that specifies that class is serialiazable. It's special in that unlike a normal interface it does not define any methods that must be implemented: it is simply marking the class as serializable. For more info see the Java docs.
As to what "serializable" means it simply means converting an instance of a class (an object) into a format where it can be written to disk, or possibly transmitted over a network. You could for example save your object to disk and reload it later, with all the field values and internal state saved. See the wikipedia page for more info.
If you never serialize an instance of Person, there is no point in declaring implements Serializable. But if you don't and try to serialize an instance, you'll get a NotSerializableException.