{"record":{"id":"67a541475931445c","repo":"apache/druid","slug":"failed-to-deserialize-object","errorCode":null,"errorMessage":"Failed to deserialize object","messagePattern":"Failed to deserialize object","errorType":"exception","errorClass":"RuntimeException","httpStatus":500,"severity":"error","filePath":"extensions-core/druid-pac4j/src/main/java/org/apache/druid/security/pac4j/Pac4jSessionStore.java","lineNumber":282,"sourceCode":"    }\n    catch (IOException e) {\n      throw new RuntimeException(\"Failed to serialize object\", e);\n    }\n  }\n\n  /**\n   * Deserialize object using standard Java serialization\n   */\n  private Serializable deserializeFromBytes(byte[] data)\n  {\n    Preconditions.checkNotNull(data, \"Data to deserialize cannot be null\");\n\n    try (ByteArrayInputStream bais = new ByteArrayInputStream(data);\n         ObjectInputStream ois = new ObjectInputStream(bais)) {\n      return (Serializable) ois.readObject();\n    }\n    catch (IOException | ClassNotFoundException e) {\n      throw new RuntimeException(\"Failed to deserialize object\", e);\n    }\n  }\n\n  /**\n   * Clear sensitive data from user profiles before storing in cookies\n   */\n  private Object clearUserProfile(final Object value)\n  {\n    if (value instanceof Map<?, ?>) {\n      final Map<String, CommonProfile> profiles = (Map<String, CommonProfile>) value;\n      profiles.forEach((name, profile) -> {\n        // In pac4j 5.x, we need to manually clear sensitive data\n        // since removeLoginData() is no longer available\n        if (profile != null) {\n          profile.removeAttribute(\"access_token\");\n          profile.removeAttribute(\"refresh_token\");\n          profile.removeAttribute(\"id_token\");\n          profile.removeAttribute(\"credentials\");","sourceCodeStart":264,"sourceCodeEnd":300,"githubUrl":"https://github.com/apache/druid/blob/9b90983fd291f26935af934383ce360473179e4d/extensions-core/druid-pac4j/src/main/java/org/apache/druid/security/pac4j/Pac4jSessionStore.java#L264-L300","documentation":"Pac4jSessionStore.deserializeFromBytes uses ObjectInputStream to rebuild the user profile from cookie bytes. IOException or ClassNotFoundException means the data is corrupt, was tampered with, or was serialized with classes not present on the current classpath (e.g. after an upgrade or extension removal).","triggerScenarios":"Calling uncompressDecryptBase64 on cookie bytes whose serialized classes no longer exist (class renames, removed extension, different pac4j version), or bytes corrupted by key change/truncation.","commonSituations":"Upgrading Druid or pac4j so stored session classes changed serialVersionUID or package; profile class moved between extensions; corrupt/tampered cookies.","solutions":["Treat deserialization failure as 'no session' and force re-login (catch and clear cookie)","Keep profile classes and serialVersionUID stable across releases","Ensure the same pac4j extension versions are deployed cluster-wide","Prefer JSON-based profile serialization to avoid classpath coupling"],"exampleFix":"// before\nreturn store.uncompressDecryptBase64(cookieValue);\n// after\ntry {\n  return store.uncompressDecryptBase64(cookieValue);\n} catch (RuntimeException e) {\n  securityLogger.warn(e, \"Could not restore session from cookie\");\n  return null;\n}","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try { profile = store.uncompressDecryptBase64(cookie); } catch (RuntimeException e) { LOGGER.warn(e, \"Cannot deserialize session cookie; forcing re-login\"); clearCookie(); profile = null; }","preventionTips":["Keep profile classes stable across upgrades (package, serialVersionUID)","Deploy identical extension versions cluster-wide","Clear cookies on version upgrades if profile classes changed"],"tags":["deserialization","java","class-not-found","java-io"],"backgroundTag":"json-unmarshal-failed","analyzedSha":"9b90983fd291f26935af934383ce360473179e4d","analyzedAt":"2026-09-07T13:32:30.957Z","contentChangedAt":"2026-09-07T13:32:30.957Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}