java Spring MVC - 我的域类是否应该为在线传输实现可序列化？

Spring MVC - should my domain classes implement Serializable for over-the-wire transfer?

提问by glhr

I'm trying to learn Spring Boot by implementing a simple REST API.

我正在尝试通过实现一个简单的 REST API 来学习 Spring Boot。

My understanding was that if I need to transfer an object over the wire, that object should implement Serializable.

我的理解是，如果我需要通过网络传输一个对象，该对象应该实现 Serializable。

In many examples on the net though, including official ones, domain classes that need to be transferred from server to client (or vice-versa) do not to implement Serializable.

但是，在网络上的许多示例中，包括官方示例，需要从服务器传输到客户端（反之亦然）的域类不实现可序列化。

For instance: https://spring.io/guides/gs/rest-service/

例如：https: //spring.io/guides/gs/rest-service/

But in some cases, they do:

但在某些情况下，他们会：

For instance: https://github.com/szerhusenBC/jwt-spring-security-demo/blob/master/src/main/java/org/zerhusen/security/JwtAuthenticationRequest.java

例如：https: //github.com/szerhusenBC/jwt-spring-security-demo/blob/master/src/main/java/org/zerhusen/security/JwtAuthenticationRequest.java

Is there a general rule of thumb on when to implement Serializable?

关于何时实现 Serializable 是否有一般的经验法则？

采纳答案by Nathan Hughes

To update this, advice about Serializable has changed, the recommendation currently seems to be Don't use Serializable for anything.

为了更新这一点，关于 Serializable 的建议已经改变，目前的建议似乎是Don't use Serializable for anything。

Using the Java serialization API means you need something in Java on the other side of the wire to deserialize the objects, so you have to control the code that deserializes as well as the code that serializes.

使用 Java 序列化 API 意味着您需要在线路的另一端使用 Java 来反序列化对象，因此您必须控制反序列化的代码以及序列化的代码。

This typically isn't relevant for REST applications, consuming the application response is the business of someone else's code, usually outside your organization. When building a REST application it's normal to try to avoid imposing limitations on what is consuming it, picking a format that is more technology-agnostic and broadly available.

这通常与 REST 应用程序无关，使用应用程序响应是其他人代码的业务，通常在您的组织之外。在构建 REST 应用程序时，通常会尽量避免对使用它的内容施加限制，选择一种与技术无关且广泛可用的格式。

Some reasons for making an object serializable would be:

使对象可序列化的一些原因是：

• so you can put it in an HttpSession

• so you can pass it across a network between parts of a distributed application

• so you can save it to the file system and restore it later (for instance, you could make the contents of a queue serializable and have the queue contents saved when the application shuts down, reading from the save location when the application starts to restore the queue to its state on shutdown).

• 所以你可以把它放在一个 HttpSession 中

• 这样您就可以在分布式应用程序的各个部分之间通过网络传递它

• 因此您可以将其保存到文件系统并稍后恢复（例如，您可以使队列的内容可序列化并在应用程序关闭时保存队列内容，在应用程序开始恢复时从保存位置读取在关机时排队进入其状态）。

In all these cases, you serialize so you can save something to a filesystem or send it across a network.

在所有这些情况下，您都会进行序列化，以便将某些内容保存到文件系统或通过网络发送。

回答by Setu

The specific examples you have mentioned do not transfer objects over the wire. From the example links I see that the controller methods return a domain object with ResponseBodyannotation. Just because the return type of the method is the domain object it is not necessary that the whole object is being sent to the client. One of the handler method in Spring mvc framework internally intercepts the invocation and determines that the method return type does not translate to direct ModelAndViewobject. RequestResponseBoodyMethodProcessorwhich handles the return value of such annotated methods and uses one of the message converters to write the return object to the http response body. In the case the message converter used would be MappingHymanson2HttpMessageConverter. So if are to follow the same coding style you are not required to implement Serializablefor your domain objects.

您提到的具体示例不会通过网络传输对象。从示例链接中，我看到控制器方法返回一个带ResponseBody注释的域对象。仅仅因为方法的返回类型是域对象，就没有必要将整个对象发送到客户端。Spring mvc 框架中的处理程序方法之一在内部拦截调用并确定方法返回类型不会转换为直接ModelAndView对象。RequestResponseBoodyMethodProcessor它处理此类带注释的方法的返回值，并使用消息转换器之一将返回对象写入 http 响应正文。在这种情况下，使用的消息转换器将是MappingHymanson2HttpMessageConverter. 因此，如果要遵循相同的编码风格，则不需要实施Serializable为您的域对象。

Have a look at this linkfor the Http message converters provided by default from spring. The list is quiet extensive however not exhaustive and if requirements arise you can implement your own custom message converter to user as-well.

查看此链接，了解 spring 默认提供的 Http 消息转换器。该列表非常广泛，但并不详尽，如果出现需求，您也可以为用户实现自己的自定义消息转换器。

回答by Du Jianyu

that's a good question when to implement Serializable interface.

这是什么时候实现 Serializable 接口的好问题。

these links can provides some useful contents:

这些链接可以提供一些有用的内容：

Serializing java.io.Serializable instance into JSON with Spring and Hymanson JSON

使用 Spring 和 Hymanson JSON 将 java.io.Serializable 实例序列化为 JSON

When and why JPA entities should implement Serializable interface?

何时以及为什么 JPA 实体应该实现 Serializable 接口？

I sometimes wonder about this,and I think

我有时想知道这个，我想

Because Java is a open source language,and more libraries providered by third party.for tells who will serialize and deserialize the object,the java offical declare a constract interface,makes transfer easy and safety throught different library.

由于Java是一种开源语言，第三方提供的库较多。for告诉谁来序列化和反序列化对象，java官方声明了一个constract接口，通过不同的库使得传输变得容易和安全。

It's just a constract,most third-party libraries can serialize/deserialize when checking implement this constract.and Hymanson's jar library is not use it.

这只是一个constract，大多数第三方库在检查实现这个constract时可以序列化/反序列化。Hymanson的jar库没有使用它。

So you can deem if you use serialize/deserialize object data in your own system,and simple process,likes just serialize and response it(Hymanson in spring MVC),you needn't to implements it. but if you used in other jar library,likes saving in HttpSession,or other third-party componens/library,you should(or have to) implement Serializable,otherwise the libraries will throw a exception to tell you the constract interfaced which it knows is not provide.

所以你可以认为如果你在自己的系统中使用序列化/反序列化对象数据，并且简单的过程，就像只是序列化和响应它（spring MVC中的Hymanson），你不需要实现它。但是如果你在其他 jar 库中使用，喜欢保存在 HttpSession 或其他第三方组件/库中，你应该（或必须）实现 Serializable，否则这些库会抛出异常告诉你它知道的契约接口是不提供。

But they said it's a good habit and best properties that to implement the Serializable when serialize a custom class. :)

但是他们说在序列化自定义类时实现Serializable是一个好习惯和最佳属性。:)

回答by a better oliver

There are many ways to serialize an object. Java's object serialization is just one of them. From the official documentation:

有很多方法可以序列化一个对象。Java 的对象序列化只是其中之一。来自官方文档：

To serialize an object means to convert its state to a byte stream

序列化对象意味着将其状态转换为字节流

REST APIs usually send and receive JSON or XML. In that case serializing an object means converting its state to a String.

REST API 通常发送和接收 JSON 或 XML。在这种情况下，序列化对象意味着将其状态转换为String。

There is no direct connection between "sending an object over the wire" and implementing Serializable. The technologies you use dictate whether or not Serializablehas to be implemented.

“通过网络发送对象”和实现Serializable. 您使用的技术决定了是否Serializable必须实施。