Java serialization is the process of converting an object into a byte stream for storage or transmission, while deserialization is the process of restoring an object. 1. Implement the Serializable interface to enable serialization; 2. Use ObjectOutputStream to write objects to a file or network; 3. Use transient keyword to exclude sensitive fields; 4. Define serialVersionUID to improve class version compatibility; 5. Deserialization requires ObjectInputStream and ensure that the class path exists; 6. Nested objects also need to implement Serializable; 7. Avoid deserializing untrusted data to prevent security risks. Note that native serialization performance is low, and it is recommended to use JSON or binary protocol instead in large-scale scenarios.

Java serialization and deserialization are very common in actual development, especially when you need to save the object state or transfer objects on the network. Simply put, serialization is to convert the object into a byte stream, and deserialization is to restore the byte stream to an object . If you are dealing with persistence or remote calls of Java objects, this step is almost inaccessible.

Let’s take a look at how to implement these two operations in Java, as well as some things to pay attention to.

What is Java serialization?

Java serialization refers to the process of converting a Java object into a sequence of bytes. This process can save the state of the object, such as writing to a file, transferring over the network, or storing it into a database. To implement serialization, the easiest way is to let the class implement the Serializable interface.

 public class User implements Serializable {
    private String name;
    private int age;

    //Constructor method, getter and setter omitted}

Note: Serializable is a tag interface and there is no method to implement. It just tells the JVM that this class can be serialized.

How to serialize objects?

To truly turn an object into a byte stream, you need to use ObjectOutputStream . Usually we will write files with FileOutputStream :

 User user = new User("Alice", 25);

try (ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("user.ser"))) {
    oos.writeObject(user);
} catch (IOException e) {
    e.printStackTrace();
}

Some things to note:

• If certain fields in the class do not require serialization (such as sensitive information), they can be modified with the transient keyword.
• If the class structure changes (such as adding fields), deserialization may fail by default. Compatibility can be controlled by defining serialVersionUID .
• Static variables are not serialized because they belong to classes rather than objects.

Deserialization: How to restore an object from a byte stream?

With the user.ser file generated earlier, we can use ObjectInputStream to read the object back:

 try (ObjectInputStream ois = new ObjectInputStream(new FileInputStream("user.ser"))) {
    User user = (User) ois.readObject();
    System.out.println(user.getName()); // Output Alice
} catch (IOException | ClassNotFoundException e) {
    e.printStackTrace();
}

Here are a few details to note:

• You must make sure that the deserialized class exists in the current classpath, otherwise ClassNotFoundException will be thrown.
• If you modify the class structure (such as delete a field), but want to be compatible with old data, remember to keep the same serialVersionUID .
• If other custom objects are nested in the object, these nested objects must also implement the Serializable interface.

FAQs and Suggestions

• Why is the deserialized object value wrong?
  Check whether the transient field is used, or whether the class structure has incompatible changes.

• Can we do serialization without implementing Serializable ?
  Third-party libraries such as Gson, Jackson, or Protobuf can be used, but native Serializable is more suitable for local object persistence.

• How is the performance?
  Java native serialization efficiency is not high, especially in large data volume or high-frequency network communication scenarios, it is recommended to consider alternatives.

• What should you pay attention to in terms of safety?
  Don't deserialize untrusted data casually, because malicious code may be executed. Especially when receiving external input, be sure to make sure to perform checksum isolation.

In general, Java native serialization mechanisms, while simple to use, are limited in flexibility, performance, and security. It is sufficient for most internal systems or small-scale applications, but if performance requirements are high or cross-language support is required, you can consider JSON or binary protocols. Basically all this is it, it is not complicated to use but it is easy to ignore details.

The above is the detailed content of Implementing Java Serialization and Deserialization. For more information, please follow other related articles on the PHP Chinese website!