## Why is this an issue?

`HttpSession` s are managed by web servers and can be serialized and stored on disk as the server manages its memory use in a process called "passivation" (and later restored during "activation").

Even though `HttpSession` does not extend `Serializable`, you must nonetheless assume that it will be serialized. If non-serializable objects are stored in the session, serialization might fail.

### Noncompliant code example

    public class Address {
      //...
    }

    HttpSession session = request.getSession();
    session.setAttribute("address", new Address());  // Noncompliant; Address isn't serializable

### Compliant solution

    public class Address implements Serializable {
      //...
    }

    HttpSession session = request.getSession();
    session.setAttribute("address", new Address());

## Resources

- OWASP - Top 10 2021 Category A4 - Insecure Design
- CWE - CWE-579 - J2EE Bad Practices: Non-serializable Object Stored in Session