How do you prevent a child class from being serialized? | Core Java

Q: How to prevent

public class Account implements Serializable { private String accountId; } public class SecureAccount extends Account { private String encryptionKey; // must NOT leave the JVM // Prevent serialization private void writeObject(ObjectOutputStream out) throws IOException { throw new NotSerializableExce

Q: What are common mistakes?

A common mistake is forgetting to declare serialVersionUID, which causes deserialization failures when the class changes. Wrong approach: package com.bank.model; import java.io.Serializable; // WRONG: no serialVersionUID public class Account implements Serializable { private String accountId; privat

Definition

Override writeObject() in the child to throw NotSerializableException. This prevents serialization even though the parent is Serializable.

The technique:

DIAGRAM

- **Problem:** Parent implements Serializable → all children inherit it.
- **Fix:** Override `writeObject` in the child to throw:

JAVA

private void writeObject(ObjectOutputStream out) throws IOException {
    throw new NotSerializableException("SecureAccount cannot be serialized");
}

The bank's general account form can be photocopied (Serializable parent). The secure vault account form (child) has a "do not copy" override that rejects photocopying.

Understanding the Concepts

How to prevent

JAVA

public class Account implements Serializable {
    private String accountId;
}

public class SecureAccount extends Account {
    private String encryptionKey;  // must NOT leave the JVM

    // Prevent serialization
    private void writeObject(ObjectOutputStream out) throws IOException {
        throw new NotSerializableException(getClass().getName());
    }

    private void readObject(ObjectInputStream in) throws IOException {
        throw new NotSerializableException(getClass().getName());
    }
}

// new ObjectOutputStream(...).writeObject(new SecureAccount(...))
// → throws NotSerializableException

What are common mistakes?

A common mistake is forgetting to declare serialVersionUID, which causes deserialization failures when the class changes.

Wrong approach:

JAVA

package com.bank.model;

import java.io.Serializable;

// WRONG: no serialVersionUID
public class Account implements Serializable {
    private String accountId;
    private java.math.BigDecimal balance;
}
// If you add a field later, old serialized data cannot be read

Correct approach:

JAVA

package com.bank.model;

import java.io.Serializable;
import java.math.BigDecimal;

// CORRECT: explicit serialVersionUID
public class Account implements Serializable {
    private static final long serialVersionUID = 1L;
    private String accountId;
    private BigDecimal balance;
}
// Adding new fields with defaults still allows reading old data

Another mistake is serializing sensitive fields like passwords or PINs. Always mark them transient to exclude them from the byte stream.

What should a senior engineer know?

A senior engineer should understand that Java serialization has well-known security vulnerabilities and should be avoided for external communication.

Deserialization attacks. Untrusted byte streams can execute arbitrary code. Use ObjectInputFilter (Java 9+) to whitelist allowed classes.
Alternative formats. Use JSON (Jackson/Gson) or Protocol Buffers for API communication in banking systems.
Serialization proxy pattern. Described in Effective Java, this pattern defends against invalid deserialized states.
Record serialization (Java 16+). Records use a canonical constructor for deserialization, which is inherently safer.

JAVA

package com.bank.model;

import java.io.*;

public class AccountSerializationFilter {
    public static void main(String[] args) {
        // Java 9+: restrict deserialization to safe classes
        ObjectInputFilter filter = ObjectInputFilter.Config.createFilter(
            "com.bank.model.*;!*"
        );
        // Apply to ObjectInputStream
    }
}

What are the edge cases?

Edge cases can cause unexpected behavior in banking applications. Here are some to watch for.

JAVA

package com.bank.edge;

public class EdgeCaseDemo {
    public static void main(String[] args) {
        // Edge case 1: null handling
        String accountId = null;
        try {
            System.out.println(accountId.length());
        } catch (NullPointerException e) {
            System.out.println("Null account ID");
        }

        // Edge case 2: empty vs null
        String emptyId = "";
        System.out.println(emptyId.isEmpty());  // true
        System.out.println(emptyId == null);     // false

        // Edge case 3: boundary values
        java.math.BigDecimal zero = java.math.BigDecimal.ZERO;
        java.math.BigDecimal negativeBalance = new java.math.BigDecimal("-0.01");
        System.out.println(zero.compareTo(negativeBalance) > 0);  // true
    }
}

TEXT

Null account ID
true
false
true

Always test with null values, empty strings, boundary values, and negative amounts in banking applications.

What are common interview follow-up questions?

Interviewers often follow up with these related questions:

How does this concept apply to a high-throughput banking transaction system?
What are the performance implications in a production environment?
How would you debug issues related to this concept?
What tools would you use to monitor this in production?
How does this behave differently in Java 8 vs Java 17+?

When answering follow-up questions, always relate your answer back to practical experience. For example, at National Bank of India, Rajesh debugged a production issue related to this concept by using JFR recordings and heap dumps. Providing concrete examples from banking systems shows the interviewer that you understand both the theory and the practice.

Visual Overview

DIAGRAM

  Account (Serializable) ← serializable
    └── SecureAccount ← inherits Serializable
          writeObject() → throw NotSerializableException
          readObject()  → throw NotSerializableException
          → effectively NOT serializable

Key Takeaway

If a parent is Serializable, all children inherit it. To prevent a child from being serialized, override writeObject() to throw NotSerializableException.

One sentence to remember: override writeObject() to throw NotSerializableException in the child to block inherited serialization.

---