setAttribute: Non-serializable attribute (Java Object Serialization)

Question

We just switched to Glassfish V2. We are now getting errors when setting a session attribute.

Error is:

java.lang.IllegalArgumentException: PWC2788: setAttribute: Non-serializable attribute

Code is:

getRequest().getSession().setAttribute("questionsForUser", getQuestions());

getQuestions() is just a simple getter which is inside an abstract class named 'Parent Action'....so to make getQuestions() a serialized object does my class need to implement serializable?:

public List getQuestions() {
    return questions;
}

• How can we make this object serializable?
• is it a good practice to only put serialized object in the session (as Glassfish appears to be requiring)?
• Are there risks of sessions being swapped between users with serialized objects?

Edit: I am using ORM (iBatis)

More Information about "Questions"

setter:

public void setQuestions(List questions) {
    this.questions = questions;
}

setter is called inside this method. this method calls the iBatis mappings.

public void prepareQuestions()
{        
setExamIfaceDAO((SecurityExamIfaceDAO)ApplicationInitializer.getApplicationContext().getBean("securityExamIfaceDAO"));
    String userRole = questionsBasedOnUserRole();
    int questionsToBeShown = 0;
    if (userRole.equalsIgnoreCase("C"))
        questionsToBeShown = 15;
    else if (userRole.equalsIgnoreCase("U"))
        questionsToBeShown = 10;
    List local_questions = getExamIfaceDAO().getSecurityQuestions(userRole);
    Collections.shuffle(local_questions);
    if (local_questions.size()>=questionsToBeShown)
        setQuestions(local_questions.subList(0, questionsToBeShown));
    getRequest().getSession().setAttribute("questionsForUser", getQuestions());
}

Answer 1

You can make the object serializable by using a serializable List implementation and making sure that the objects in the list are also serializable.

Yes -- it is good practice to only put serializable objects in the session since this will allow your application to be run on a server with multiple nodes. Even if you don't care about this at the moment it might be useful in future.

The servlet container should ensure that sessions are not swapped between users. Making objects stored in the session serializable allows the container to 'distribute' the session state across multiple nodes in a cluster, allowing the user who owns the session to have requests serviced by any node.