界: Time and State

分布式计算是关于时间和状态的。也就是说，为了让多个组件相互通信，必须共享状态，所有这些都需要时间。

大多数程序员都会将其工作拟人化。他们会让一个控制线程以同样的方式（他们必须自己完成工作时采取的方式）执行整个程序。然而，现代计算机不同任务之间切换得非常快，在多核、多 CPU 或分布式系统中，两个事件可能完全同时发生。程序员预期的程序执行过程与实际情况之间存在差距，即存在缺陷。这些缺陷与线程、流程、时间和信息之间的意外交互有关。这些交互是通过共享状态发生的：信号量、变量、文件系统，以及总而言之，可以存储信息的任何内容。

J2EE Bad Practices: Non-Serializable Object Stored in Session

Java/JSP

Abstract

把一个不可序列化的对象作为 HttpSession 属性来储存会破坏应用程序的可靠性。

Explanation

一个 J2EE 应用程序可以利用多个 JVM，以提高应用程序的可靠性和性能。为了在最终用户中将多个 JVM 显示为单个的应用程序，J2EE 容器可以在多个 JVM 之间复制 HttpSession 对象，所以当一个 JVM 不可用时，另一个 JVM 可以在不中断应用程序流程的情况下接替步骤的执行。

为了使会话复制能够正常运行，作为应用程序属性存储在会话中的数值必须实现 Serializable 接口。

例 1：下面这个类把自己添加到会话中，但由于它不是可序列化的，因此该会话就再也不能被复制了。


public class DataGlob {
   String globName;
   String globValue;

   public void addToSession(HttpSession session) {
     session.setAttribute("glob", this);
   }
}

References

[1] The Java Servlet Specification Sun Microsystems

[2] The java.io.Serializable Interface Oracle

[3] MSC08-J. Do not store non-serializable objects as attributes in an HTTP session CERT

[4] Standards Mapping - Common Weakness Enumeration CWE ID 579

[5] Standards Mapping - OWASP Mobile 2014 M1 Weak Server Side Controls

[6] Standards Mapping - OWASP Top 10 2004 A3 Broken Authentication and Session Management

[7] Standards Mapping - OWASP Top 10 2007 A7 Broken Authentication and Session Management

[8] Standards Mapping - OWASP Top 10 2010 A3 Broken Authentication and Session Management

[9] Standards Mapping - OWASP Top 10 2013 A2 Broken Authentication and Session Management

[10] Standards Mapping - OWASP Top 10 2017 A2 Broken Authentication

[11] Standards Mapping - OWASP Top 10 2021 A07 Identification and Authentication Failures

[12] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.3

[13] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 6.5.7

[14] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 6.5.8

[15] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 6.5.10

[16] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 6.5.10

[17] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 6.5.10

[18] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.10

[19] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4

[20] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 4.2 - Critical Asset Protection

[21] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 4.2 - Critical Asset Protection

[22] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 4.2 - Critical Asset Protection

desc.structural.java.j2ee_bad_practices_non_serializable_object_stored_in_session