thepointman.dev_

Courses / Java

Java Serialisation

advanced7 lessons

The Serializable contract and what you're actually committing to, serialVersionUID and the InvalidClassException, transient fields, custom readObject/writeObject hooks, the deserialization gadget chain attack that makes Java serialization a CVE factory, readResolve() for Singleton integrity, and when to use Jackson, Protobuf or Avro instead.

// Lessons

  1. 01

    The Serializable Contract — What You're Actually Committing To

    soon
  2. 02

    serialVersionUID — The Most Ignored Field in Java

    soon
  3. 03

    transient — Excluding Fields from Serialization

    soon
  4. 04

    readObject() and writeObject() — Custom Serialization Hooks

    soon
  5. 05

    The Gadget Chain Attack — Why Java Deserialization Is a CVE Factory

    soon
  6. 06

    readResolve() — Singleton Integrity During Deserialization

    soon
  7. 07

    Modern Alternatives — Jackson, Protobuf and Avro Compared

    soon