{"record":{"id":"325c9f91cc1c3ea4","repo":"apereo/cas","slug":"object-value-assigned-to-is-not-serializ","errorCode":null,"errorMessage":"Object value [{}] assigned to [{}] is not serializable and may not be part of the ticket [{}]","messagePattern":"Object value \\[(.+?)\\] assigned to \\[(.+?)\\] is not serializable and may not be part of the ticket \\[(.+?)\\]","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-pac4j-api/src/main/java/org/apereo/cas/pac4j/TicketRegistrySessionStore.java","lineNumber":68,"sourceCode":"            return Optional.empty();\n        }\n        return Optional.ofNullable(ticket.getProperties().get(key));\n    }\n\n    @Override\n    public void set(final WebContext context, final String key, final Object value) {\n        LOGGER.trace(\"Setting key: [{}]\", key);\n        val sessionId = getSessionId(context, true).orElseGet(() -> {\n            val newSessionId = UUID.randomUUID().toString();\n            LOGGER.trace(\"Generated session id: [{}]\", newSessionId);\n            return newSessionId;\n        });\n\n        val properties = new HashMap<String, Serializable>();\n        if (value instanceof final Serializable serializable) {\n            properties.put(key, serializable);\n        } else if (value != null) {\n            LOGGER.warn(\"Object value [{}] assigned to [{}] is not serializable and may not be part of the ticket [{}]\", value, key, sessionId);\n        }\n        \n        val ticket = getTransientSessionTicketForSession(context);\n\n        if (value == null && ticket != null) {\n            ticket.getProperties().remove(key);\n            updateTicket(context, ticket);\n        } else if (ticket == null) {\n            FunctionUtils.doAndHandle(_ -> {\n                val transientFactory = (TransientSessionTicketFactory) ticketFactory.get(TransientSessionTicket.class);\n                val transientSessionTicket = transientFactory.create(sessionId, properties);\n                val addedTicket = ticketRegistry.addTicket(transientSessionTicket);\n                \n                val webContext = (JEEContext) context;\n                cookieGenerator.addCookie(webContext.getNativeRequest(), webContext.getNativeResponse(), addedTicket.getId());\n\n                context.setRequestAttribute(SESSION_ID_IN_REQUEST_ATTRIBUTE, addedTicket.getId());\n            });","sourceCodeStart":50,"sourceCodeEnd":86,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-pac4j-api/src/main/java/org/apereo/cas/pac4j/TicketRegistrySessionStore.java#L50-L86","documentation":"TicketRegistrySessionStore.set stores pac4j session values as properties on a transient session ticket, which requires values to be Serializable. When the value set for a session key is neither null nor java.io.Serializable, it cannot be attached to the ticket, so this warning is logged and the value is effectively dropped (not persisted).","triggerScenarios":"Calling TicketRegistrySessionStore.set(context, key, value) with a non-Serializable object as value during delegated (pac4j) authentication session data handling.","commonSituations":"Custom pac4j clients or profile/authorization code storing complex (non-Serializable) objects in the session store; library upgrades introducing new session values that are not Serializable; storing request-bound objects in the distributed session.","solutions":["Make the stored value Serializable (implement java.io.Serializable on its class, or store a serializable DTO/String instead).","Convert the value to a serializable representation (e.g. JSON string) before calling set().","If the value is intentionally transient, ignore the warning or avoid putting that key in the ticket-backed session store."],"exampleFix":"// before\nsessionStore.set(ctx, \"cart\", new Cart(...)); // Cart not Serializable\n// after\npublic class Cart implements java.io.Serializable { ... }\nsessionStore.set(ctx, \"cart\", cart);","handlingStrategy":"type-guard","validationCode":"if (value == null || value instanceof java.io.Serializable) { sessionStore.set(ctx, key, value); } else { sessionStore.set(ctx, key, serializeToJson(value)); }","typeGuard":"static boolean isStorable(Object v) { return v == null || v instanceof java.io.Serializable; }","tryCatchPattern":null,"preventionTips":["Only store Serializable DTOs in ticket-backed session stores.","Add an assertion in custom client code that every session value implements Serializable."],"tags":["pac4j","session-store","serialization","ticket-registry"],"backgroundTag":"json-serialization-failed","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}