HttpSession s are managed by web servers and can be serialized and stored on disk as the server manages its memory use in a process
called "passivation" (and later restored during "activation").
Even though HttpSession does not extend Serializable, you must nonetheless assume that it will be serialized. If
non-serializable objects are stored in the session, serialization might fail.
Noncompliant code example
public class Address {
//...
}
HttpSession session = request.getSession();
session.setAttribute("address", new Address()); // Noncompliant; Address isn't serializable
Compliant solution
public class Address implements Serializable {
//...
}
HttpSession session = request.getSession();
session.setAttribute("address", new Address());
