Question

Analysing the server application I’ve found some point, that with relation to session serializazion and deserialization could be dangerous. The servlet layer in many places uses session to store object.

Consider the sequence:

1) Object A is save to session

2) Object A is modified

3) Object A is read from session as object B

Is it possible, that before 1) and 2) the serialization occurs, and the object read as B is the deserialized version of object A before the changes from 3?

Or I’m guaranteed, that, as long as 1, 2, 3 happens in the same request, A and B will be equal?

Answer 1

Your code shouldn’t depend on objects you put in the session being the same instance, so long as they are semantically equal as implied by the equals method then that should be enough.

There are of course various reasons when sessions could be serialized whether it’s so sessions to survive server restarts or because the server is part of a cluster.