Why do you have to mark a class with the attribute [serializable]?

Question

Seeing as you can convert any document to a byte array and save it to disk, and then rebuild the file to its original form (as long as you have meta data for its filename etc.).

Why do you have to mark a class with [Serializable] etc? Is that just the same idea, "meta data" type information so when you cast the object to its class things are mapped properly?

Solution 1

First off, you don't have to.

It is simply a marker interface that tells the serializer that the class is composed of items that it can serialize (which may or may not be true) and that is can use the default serialization.

The XMLSerializer has the additional requirement to have a zero parameter constructor to the class.

There are other serializers that use contracts for serialization (such as the DataContractSerializer) - they give you more control over serialization than simply marking a class as Serializable. You can also get more control by implementing the ISerializable interface.

Solution 2

Binary serialization is pretty powerful, it can create an instance of a class without running the constructor and can set fields in your class that you declared private. Regular code can of course not do this. By applying the [Serializable] attribute, you explicitly give it the go-ahead to mess with your private parts. And you implicitly give that permission to only the BinaryFormatter class.

XML serialization doesn't need this kind of okay, it only serializes members that are public.

DataContractSerializer can serialize private members as well. It therefore needs an explicit okay again, now with the [DataContract] attribute.

Solution 3

It's basically metadata that indicates that a class can be serialized, nothing more.

It is required by a lot of framework serializers, which refuse to deal with types not having this attribute applied to them.

Solution 4

Serialization can create security holes and may be plagued by versioning problems. On top of that, for some classes, the very idea of serialization is outright nonsense.

For details, see the excellent answers to Why Java needs Serializable interface?, especially this one, this one, and this one. They make the case that serialization should be a feature you have to explicitly opt into.

For a counterpoint, the accepted answer to that question makes the case that classes should be serializable by default.

Solution 5

It indicates to the serializer that you want that class to be serialized as you may not want all properties or classes to be serialized.

View more solutions

Comments

[Lasse V. Karlsen]

It can only be applied to types, not members.

[Raquel]

The XmlSerializer does not require SerializableAttribute

[John Saunders]

@Oded: -1 until you edit your answer to show that the XmlSerializer doesn't care about [Serializable].

[Oded]

@Matthew Whited, @John Saunders - thanks for the correction. Answer updated.

[Michael Stum]

Just chiming in to recommend the chapter about serializing in "Framework Design Guidelines" by Krzysztof Cwalina and Brad Abrams which explains a bit when to use what from the standpoint of a Framework designer.

[EMP]

I think this is a bit misleading - it sounds like if I have a serializable class A with a member B of a non-serializable type then member B will be ignored. In actual fact, serializing A will throw.

[Daniel Mošmondor]

You do have to. BinaryFormatter WON'T budge otherwise! I mean, it will throw on you...

[Thomas]

when it is not require decorate a class with serializable keyword then why peole do it...any special reason?

[tsemer]

-1 until answer is corrected: Against popular belief, DataContractSerializer does not force you to mark a class [DataContract], it is a choice. When no attribute decorates the class, the serializer will by default infer a contract of all public read/write properties and fields. See MSDN: msdn.microsoft.com/en-us/library/ms733127%28v=vs.110%29.aspx

[user1703401]

The word "public" in that sentence appears to mystify you.

[nawfal]

Just in case it helps somebody, DataContractSerializer doesn't need [DataContract] attribute necessarily. [Serializable] will do (by which you also need not mark everything you need to serialize by [DataMember]).

[nawfal]

@Thomas this thread is all about answering that question. See Hans's answer, clearer. Basically, it is not required to if all you care about is public members (for non-public you do need some serializable attribute). You also do need if you have some custom requirement (like excluding some field).

[nawfal]

but cant interoperate with non .NET domains.

[Vilx-]

Fun fact: with the help of the FormatterServices class, you too can create uninitialized objects! Evil! :)

[Some Guy]

"Regular code can of course not do this."

[Some Guy]

Can't you just write a setter method to change private fields?