How (at an implementation level) does Java RMI load+define classes?

Question

When RMI (the sun.rmi implementation in Sun VMs) is de-serializing an object, as part of either the parameters or return value of a remote call, it needs to go from the class's name (a string in the serialized data) to a Class object. How does RMI decide which ClassLoader to use to define the class?

Answer 1

By default Java deserialisation searches down the stack for the first non-system class and uses its class loader (i.e. the first non-null class loader). RMI adds annotations the serial stream to give the location (URL) where the classes should be downloaded from. By default, RMI class loaders uses that location to find additional classes. There is a system property to switch that behaviour off (not a bad idea).