Serialization and Data Boundaries
Java's built-in object serialization has compatibility and security concerns. For network APIs, JSON, Protobuf, Avro, or other explicit formats are often better because the wire contract is visible and language interoperability is easier.
public record UserDto(String id, String name) {}
DTOs separate external representations from internal domain models. If a system consumes untrusted serialized data, treat deserialization as a security boundary and avoid arbitrary object construction.
Untrusted deserialization
Never treat untrusted serialized object data as harmless input. Prefer explicit, constrained data formats.
Key Takeaways
- Wire formats are API contracts.
- DTOs protect internal models from external coupling.
- Security must be considered at every deserialization boundary.