{"record":{"id":"bfe17aea65e7c46c","repo":"apache/druid","slug":"failed-to-serialize-object","errorCode":null,"errorMessage":"Failed to serialize object","messagePattern":"Failed to serialize object","errorType":"exception","errorClass":"RuntimeException","httpStatus":500,"severity":"error","filePath":"extensions-core/druid-pac4j/src/main/java/org/apache/druid/security/pac4j/Pac4jSessionStore.java","lineNumber":266,"sourceCode":"      throw new RuntimeException(\"Decompression failed\", ex);\n    }\n  }\n\n  /**\n   * Serialize object using standard Java serialization\n   */\n  private byte[] serializeToBytes(Serializable obj)\n  {\n    Preconditions.checkNotNull(obj, \"Object to serialize cannot be null\");\n\n    try (ByteArrayOutputStream baos = new ByteArrayOutputStream();\n         ObjectOutputStream oos = new ObjectOutputStream(baos)) {\n      oos.writeObject(obj);\n      oos.flush();\n      return baos.toByteArray();\n    }\n    catch (IOException e) {\n      throw new RuntimeException(\"Failed to serialize object\", e);\n    }\n  }\n\n  /**\n   * Deserialize object using standard Java serialization\n   */\n  private Serializable deserializeFromBytes(byte[] data)\n  {\n    Preconditions.checkNotNull(data, \"Data to deserialize cannot be null\");\n\n    try (ByteArrayInputStream bais = new ByteArrayInputStream(data);\n         ObjectInputStream ois = new ObjectInputStream(bais)) {\n      return (Serializable) ois.readObject();\n    }\n    catch (IOException | ClassNotFoundException e) {\n      throw new RuntimeException(\"Failed to deserialize object\", e);\n    }\n  }","sourceCodeStart":248,"sourceCodeEnd":284,"githubUrl":"https://github.com/apache/druid/blob/9b90983fd291f26935af934383ce360473179e4d/extensions-core/druid-pac4j/src/main/java/org/apache/druid/security/pac4j/Pac4jSessionStore.java#L248-L284","documentation":"Pac4jSessionStore.serializeToBytes uses Java ObjectOutputStream to serialize the user profile for cookie storage. IOException here is unexpected — ObjectOutputStream on a ByteArrayOutputStream rarely fails — and indicates a serious serialization problem such as an unserializable or deeply nested object graph surfaced late by the stream.","triggerScenarios":"Calling bytes() on a user profile object whose class does not implement Serializable properly, or whose nested fields throw during writeObject (e.g. custom writeObject failures).","commonSituations":"Adding a non-Serializable field (e.g. a HttpServletRequest reference or logger) to the user profile class; third-party pac4j profile classes holding unserializable members.","solutions":["Ensure the profile object and all reachable fields implement java.io.Serializable","Mark transient any non-serializable fields (loggers, handles)","Add serialVersionUID to profile classes to also avoid later deserialization mismatches","Consider JSON serialization instead of Java serialization for cookie storage"],"exampleFix":"// before\npublic class MyProfile extends CommonProfile {\n  private final Logger log = LoggerFactory.getLogger(getClass()); // not serializable\n}\n// after\npublic class MyProfile extends CommonProfile {\n  private transient Logger log = LoggerFactory.getLogger(getClass());\n}","handlingStrategy":"validation","validationCode":"// Verify serializability before storing\nif (!(profile instanceof java.io.Serializable)) { throw new IllegalArgumentException(\"profile must be Serializable\"); }\nnew java.io.ObjectOutputStream(new java.io.ByteArrayOutputStream()).close(); // warm check","typeGuard":"static boolean isSerializable(Object o) { return o instanceof java.io.Serializable; }","tryCatchPattern":"try { bytes = store.bytes(profile); } catch (RuntimeException e) { LOGGER.error(e, \"Profile not serializable\"); }","preventionTips":["Make every profile field Serializable or transient","Add explicit serialVersionUID","Avoid storing framework objects (loggers, requests) in profiles"],"tags":["serialization","java","java-io"],"backgroundTag":"json-serialization-failed","analyzedSha":"9b90983fd291f26935af934383ce360473179e4d","analyzedAt":"2026-09-07T13:32:30.957Z","contentChangedAt":"2026-09-07T13:32:30.957Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}