Answer.

Serialization is a mechanism for converting an object into a stream of bytes for subsequent storage or transmission. In Java, serialization was introduced with the platform in version 1.1 as part of the API due to the popularity of distributed applications and the need for data exchange between them. This solution allowed simplifying the transmission of complex object graphs between JVMs and storing their state, making the process transparent to the developer.

The problem of serialization lies in the necessity to strictly maintain data integrity, support class versioning, and correctly handle complex structures (such as graphs with cyclic references). Not all objects are serializable (e.g., streams, sockets, OS resources), and serialization requires special attention to security.

The solution is implemented using the Serializable interface:

import java.io.*;

class Person implements Serializable {
    private static final long serialVersionUID = 1L;
    private String name;
    private transient int age; // not serialized
    public Person(String name, int age) {
        this.name = name;
        this.age = age;
    }
}

Using ObjectOutputStream and ObjectInputStream, an object can be written to a file and restored:

Person p = new Person("Alice", 30);
ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("person.ser"));
oos.writeObject(p); // serialization
ObjectInputStream ois = new ObjectInputStream(new FileInputStream("person.ser"));
Person restored = (Person) ois.readObject();

Key features:

For serialization, the class must implement the Serializable interface.
Fields with the transient modifier are not serialized.
Serialization supports the saving and restoring of object graphs, including cyclic references.

Tricky questions.

Can an object with a non-serializable field be serialized if it is not used?

Answer: If the field is marked as transient, it is not serialized at all, and the process will not throw an exception, even if its type does not implement Serializable. If the field is non-serializable and not transient, a NotSerializableException will be thrown.

Is a static field serializable if the class implements Serializable?

Answer: No, static fields are not serialized because they belong to the class, not the instance. Only the state of the instance is saved.

What happens if the class structure changes after serialization (for example, adding or removing a field)?

Answer: If you specify the serialVersionUID, and the structure changes incompatibly, an InvalidClassException will occur during deserialization. To ensure compatibility, serialization hints and manual control of serialVersionUID are used.

Common mistakes and anti-patterns

Not declaring serialVersionUID and encountering errors due to incompatible class versions
Attempting to serialize objects that contain non-finalized resources (e.g., streams)
Ignoring the transient modifier, which can lead to leakage of sensitive data

Real-life example

Negative case

Engineers decided to serialize an object without adding serialVersionUID and not declaring fields that refer to OS resources as transient. After updating the application and the class, an InvalidClassException arose, and the object lost integrity, preventing deserialization from working.

Pros:

Quick implementation of state saving

Cons:

Data loss during updates
Crash during deserialization
Possible resource leaks

Positive case

A portable class with a defined serialVersionUID was implemented for serialization, all resource fields were declared as transient, and manual serialization controlled key moments.