How does "final" play a role in security? [duplicate]

Question

I have read in Wikipedia here that:

A final class cannot be subclassed. This is done for reasons of security and efficiency.

I am wondering about the kind of security that final in Java can achieve?

Answer 1

If your class is final, No one can subclass it. If no one can subclass your final class, that means your features of the final class can not be changed by other by reusing your class.

Assume you are technology provider, here you provide API for some banking system, using your API client will implement its banking system.

case: WITHOUT FINAL

This is in your API

class BaseClass{
 public void makeTransaction(){
   }
}

This is client code

class DerivedClass extends BaseClass{
 public void makeTransaction(){
     // naughty client can do something here like:- makeTransaction but transfer 1 dollar for each transaction to my account.
   }
}

case: WITH FINAL This is in your API

final class BaseClass{
 public void makeTransaction(){
   }
}

This is client code

class DerivedClass extends BaseClass{  // not allowed
}

Client has to use make transaction as you have already defined. This is one aspect how final can secure your piece of code.

Answer 2

A final class cannot be subclassed. This is done for reasons of security and efficiency.I am wondering about the kind of security that final in Java can achieve?

If a class cannot be subclassed then you cannot override the functionality that a parent class provides in a child class. From a design perspective you are actually finalizing and enforcing a design using final classes. Hence it makes your final class secured in that sense.