Serialization in Java was introduced in JDK 1.1 and it is one of the important feature of Core Java.
Serialization in Java
- Serializable in Java
- Class Refactoring with Serialization and serialVersionUID
- Java Externalizable Interface
- Java Serialization Methods
- Serialization with Inheritance
- Serialization Proxy Pattern
Serializable in Java
If you want a class object to be serializable, all you need to do it implement the java.io.Serializable interface. Serializable in java is a marker interface and has no fields or methods to implement. It’s like an Opt-In process through which we make our classes serializable. Serialization in java is implemented by ObjectInputStream and ObjectOutputStream, so all we need is a wrapper over them to either save it to file or send it over the network. Let’s see a simple Serialization in java program example.
package com.journaldev.serialization; import java.io.Serializable; public class Employee implements Serializable { // private static final long serialVersionUID = -6470090944414208496L; private String name; private int id; transient private int salary; // private String password; @Override public String toString[]{ return "Employee{name="+name+",id="+id+",salary="+salary+"}"; } //getter and setter methods public String getName[] { return name; } public void setName[String name] { this.name = name; } public int getId[] { return id; } public void setId[int id] { this.id = id; } public int getSalary[] { return salary; } public void setSalary[int salary] { this.salary = salary; } // public String getPassword[] { // return password; // } // // public void setPassword[String password] { // this.password = password; // } }Notice that it’s a simple java bean with some properties and getter-setter methods. If you want an object property to be not serialized to stream, you can use transient keyword like I have done with salary variable. Now suppose we want to write our objects to file and then deserialize it from the same file. So we need utility methods that will use ObjectInputStream and ObjectOutputStream for serialization purposes.
package com.journaldev.serialization; import java.io.FileInputStream; import java.io.FileOutputStream; import java.io.IOException; import java.io.ObjectInputStream; import java.io.ObjectOutputStream; /** * A simple class with generic serialize and deserialize method implementations * * @author pankaj * */ public class SerializationUtil { // deserialize to Object from given file public static Object deserialize[String fileName] throws IOException, ClassNotFoundException { FileInputStream fis = new FileInputStream[fileName]; ObjectInputStream ois = new ObjectInputStream[fis]; Object obj = ois.readObject[]; ois.close[]; return obj; } // serialize the given object and save it to file public static void serialize[Object obj, String fileName] throws IOException { FileOutputStream fos = new FileOutputStream[fileName]; ObjectOutputStream oos = new ObjectOutputStream[fos]; oos.writeObject[obj]; fos.close[]; } }Notice that the method arguments work with Object that is the base class of any java object. It’s written in this way to be generic in nature. Now let’s write a test program to see Java Serialization in action.
When we run above test program for serialization in java, we get following output.
emp Object::Employee{name=Pankaj,id=100,salary=5000} empNew Object::Employee{name=Pankaj,id=100,salary=0}Since salary is a transient variable, it’s value was not saved to file and hence not retrieved in the new object. Similarly static variable values are also not serialized since they belongs to class and not object.
Class Refactoring with Serialization and serialVersionUID
Serialization in java permits some changes in the java class if they can be ignored. Some of the changes in class that will not affect the deserialization process are:
- Adding new variables to the class
- Changing the variables from transient to non-transient, for serialization it’s like having a new field.
- Changing the variable from static to non-static, for serialization it’s like having a new field.
But for all these changes to work, the java class should have serialVersionUID defined for the class. Let’s write a test class just for deserialization of the already serialized file from previous test class.
package com.journaldev.serialization; import java.io.IOException; public class DeserializationTest { public static void main[String[] args] { String fileName="employee.ser"; Employee empNew = null; try { empNew = [Employee] SerializationUtil.deserialize[fileName]; } catch [ClassNotFoundException | IOException e] { e.printStackTrace[]; } System.out.println["empNew Object::"+empNew]; } }Now uncomment the “password” variable and it’s getter-setter methods from Employee class and run it. You will get below exception;
The reason is clear that serialVersionUID of the previous class and new class are different. Actually if the class doesn’t define serialVersionUID, it’s getting calculated automatically and assigned to the class. Java uses class variables, methods, class name, package etc to generate this unique long number. If you are working with any IDE, you will automatically get a warning that “The serializable class Employee does not declare a static final serialVersionUID field of type long”. We can use java utility “serialver” to generate the class serialVersionUID, for Employee class we can run it with below command.
SerializationExample/bin$serialver -classpath . com.journaldev.serialization.EmployeeNote that it’s not required that the serial version is generated from this program itself, we can assign this value as we want. It just need to be there to let deserialization process know that the new class is the new version of the same class and should be deserialized of possible. For example, uncomment only the serialVersionUID field from the Employee class and run SerializationTest program. Now uncomment the password field from Employee class and run the DeserializationTest program and you will see that the object stream is deserialized successfully because the change in Employee class is compatible with serialization process.
Java Externalizable Interface
If you notice the java serialization process, it’s done automatically. Sometimes we want to obscure the object data to maintain it’s integrity. We can do this by implementing java.io.Externalizable interface and provide implementation of writeExternal[] and readExternal[] methods to be used in serialization process.
package com.journaldev.externalization; import java.io.Externalizable; import java.io.IOException; import java.io.ObjectInput; import java.io.ObjectOutput; public class Person implements Externalizable{ private int id; private String name; private String gender; @Override public void writeExternal[ObjectOutput out] throws IOException { out.writeInt[id]; out.writeObject[name+"xyz"]; out.writeObject["abc"+gender]; } @Override public void readExternal[ObjectInput in] throws IOException, ClassNotFoundException { id=in.readInt[]; //read in the same order as written name=[String] in.readObject[]; if[!name.endsWith["xyz"]] throw new IOException["corrupted data"]; name=name.substring[0, name.length[]-3]; gender=[String] in.readObject[]; if[!gender.startsWith["abc"]] throw new IOException["corrupted data"]; gender=gender.substring[3]; } @Override public String toString[]{ return "Person{id="+id+",name="+name+",gender="+gender+"}"; } public int getId[] { return id; } public void setId[int id] { this.id = id; } public String getName[] { return name; } public void setName[String name] { this.name = name; } public String getGender[] { return gender; } public void setGender[String gender] { this.gender = gender; } }Notice that I have changed the field values before converting it to Stream and then while reading reversed the changes. In this way, we can maintain data integrity of some sorts. We can throw exception if after reading the stream data, the integrity checks fail. Let’s write a test program to see it in action.
package com.journaldev.externalization; import java.io.FileInputStream; import java.io.FileOutputStream; import java.io.IOException; import java.io.ObjectInputStream; import java.io.ObjectOutputStream; public class ExternalizationTest { public static void main[String[] args] { String fileName = "person.ser"; Person person = new Person[]; person.setId[1]; person.setName["Pankaj"]; person.setGender["Male"]; try { FileOutputStream fos = new FileOutputStream[fileName]; ObjectOutputStream oos = new ObjectOutputStream[fos]; oos.writeObject[person]; oos.close[]; } catch [IOException e] { // TODO Auto-generated catch block e.printStackTrace[]; } FileInputStream fis; try { fis = new FileInputStream[fileName]; ObjectInputStream ois = new ObjectInputStream[fis]; Person p = [Person]ois.readObject[]; ois.close[]; System.out.println["Person Object Read="+p]; } catch [IOException | ClassNotFoundException e] { e.printStackTrace[]; } } }When we run above program, we get following output.
So which one is better to be used for serialization in java. Actually it’s better to use Serializable interface and by the time we reach at the end of article, you will know why.
Java Serialization Methods
We have seen that serialization in java is automatic and all we need is implementing Serializable interface. The implementation is present in the ObjectInputStream and ObjectOutputStream classes. But what if we want to change the way we are saving data, for example we have some sensitive information in the object and before saving/retrieving we want to encrypt/decrypt it. That’s why there are four methods that we can provide in the class to change the serialization behavior. If these methods are present in the class, they are used for serialization purposes.
- readObject[ObjectInputStream ois]: If this method is present in the class, ObjectInputStream readObject[] method will use this method for reading the object from stream.
- writeObject[ObjectOutputStream oos]: If this method is present in the class, ObjectOutputStream writeObject[] method will use this method for writing the object to stream. One of the common usage is to obscure the object variables to maintain data integrity.
- Object writeReplace[]: If this method is present, then after serialization process this method is called and the object returned is serialized to the stream.
- Object readResolve[]: If this method is present, then after deserialization process, this method is called to return the final object to the caller program. One of the usage of this method is to implement Singleton pattern with Serialized classes. Read more at Serialization and Singleton.
Usually while implementing above methods, it’s kept as private so that subclasses can’t override them. They are meant for serialization purpose only and keeping them private avoids any security issue.
Serialization with Inheritance
Sometimes we need to extend a class that doesn’t implement Serializable interface. If we rely on the automatic serialization behavior and the superclass has some state, then they will not be converted to stream and hence not retrieved later on. This is one place, where readObject[] and writeObject[] methods really help. By providing their implementation, we can save the super class state to the stream and then retrieve it later on. Let’s see this in action.
package com.journaldev.serialization.inheritance; public class SuperClass { private int id; private String value; public int getId[] { return id; } public void setId[int id] { this.id = id; } public String getValue[] { return value; } public void setValue[String value] { this.value = value; } }SuperClass is a simple java bean but it’s not implementing Serializable interface.
package com.journaldev.serialization.inheritance; import java.io.IOException; import java.io.InvalidObjectException; import java.io.ObjectInputStream; import java.io.ObjectInputValidation; import java.io.ObjectOutputStream; import java.io.Serializable; public class SubClass extends SuperClass implements Serializable, ObjectInputValidation{ private static final long serialVersionUID = -1322322139926390329L; private String name; public String getName[] { return name; } public void setName[String name] { this.name = name; } @Override public String toString[]{ return "SubClass{id="+getId[]+",value="+getValue[]+",name="+getName[]+"}"; } //adding helper method for serialization to save/initialize super class state private void readObject[ObjectInputStream ois] throws ClassNotFoundException, IOException{ ois.defaultReadObject[]; //notice the order of read and write should be same setId[ois.readInt[]]; setValue[[String] ois.readObject[]]; } private void writeObject[ObjectOutputStream oos] throws IOException{ oos.defaultWriteObject[]; oos.writeInt[getId[]]; oos.writeObject[getValue[]]; } @Override public void validateObject[] throws InvalidObjectException { //validate the object here if[name == null || "".equals[name]] throw new InvalidObjectException["name can't be null or empty"]; if[getId[]