apache/druid · error · RuntimeException

Failed to serialize object

Error message

Failed to serialize object

What it means

Pac4jSessionStore.serializeToBytes uses Java ObjectOutputStream to serialize the user profile for cookie storage. IOException here is unexpected — ObjectOutputStream on a ByteArrayOutputStream rarely fails — and indicates a serious serialization problem such as an unserializable or deeply nested object graph surfaced late by the stream.

Solutions

  1. Ensure the profile object and all reachable fields implement java.io.Serializable
  2. Mark transient any non-serializable fields (loggers, handles)
  3. Add serialVersionUID to profile classes to also avoid later deserialization mismatches
  4. Consider JSON serialization instead of Java serialization for cookie storage

Example fix

// before
public class MyProfile extends CommonProfile {
  private final Logger log = LoggerFactory.getLogger(getClass()); // not serializable
}
// after
public class MyProfile extends CommonProfile {
  private transient Logger log = LoggerFactory.getLogger(getClass());
}
Defensive patterns

Strategy: validation

Validate before calling

// Verify serializability before storing
if (!(profile instanceof java.io.Serializable)) { throw new IllegalArgumentException("profile must be Serializable"); }
new java.io.ObjectOutputStream(new java.io.ByteArrayOutputStream()).close(); // warm check

Type guard

static boolean isSerializable(Object o) { return o instanceof java.io.Serializable; }

Try / catch

try { bytes = store.bytes(profile); } catch (RuntimeException e) { LOGGER.error(e, "Profile not serializable"); }

Prevention

When it happens

Trigger: Calling bytes() on a user profile object whose class does not implement Serializable properly, or whose nested fields throw during writeObject (e.g. custom writeObject failures).

Common situations: Adding a non-Serializable field (e.g. a HttpServletRequest reference or logger) to the user profile class; third-party pac4j profile classes holding unserializable members.

Understand the failure class

Background: "JSON serialization failed", "not JSON serializable", "Failed to serialize": why JSON marshaling errors happen and how to fix them — this error's family across 46 libraries.

Related errors

AI-assisted analysis of apache/druid@9b90983fd2 (2026-09-07). Data as JSON: /api/errors/bfe17aea65e7c46c. Report an issue: GitHub.

Appendix: source

Thrown at extensions-core/druid-pac4j/src/main/java/org/apache/druid/security/pac4j/Pac4jSessionStore.java:266

      throw new RuntimeException("Decompression failed", ex);
    }
  }

  /**
   * Serialize object using standard Java serialization
   */
  private byte[] serializeToBytes(Serializable obj)
  {
    Preconditions.checkNotNull(obj, "Object to serialize cannot be null");

    try (ByteArrayOutputStream baos = new ByteArrayOutputStream();
         ObjectOutputStream oos = new ObjectOutputStream(baos)) {
      oos.writeObject(obj);
      oos.flush();
      return baos.toByteArray();
    }
    catch (IOException e) {
      throw new RuntimeException("Failed to serialize object", e);
    }
  }

  /**
   * Deserialize object using standard Java serialization
   */
  private Serializable deserializeFromBytes(byte[] data)
  {
    Preconditions.checkNotNull(data, "Data to deserialize cannot be null");

    try (ByteArrayInputStream bais = new ByteArrayInputStream(data);
         ObjectInputStream ois = new ObjectInputStream(bais)) {
      return (Serializable) ois.readObject();
    }
    catch (IOException | ClassNotFoundException e) {
      throw new RuntimeException("Failed to deserialize object", e);
    }
  }

View on GitHub (pinned to 9b90983fd2)