Rule Definition
Accessing a non-serializable object as an HttpSesion attribute can result in damaging the application reliability. It could break the session replication because the deserialization will happen only for attributes stored as serializable. So it is recommended to make the class Serializable and improve the reliability of the application.

Remediation
Inherits from the class Serializable

Violation Code Sample

// Sample Code: The following class adds itself to the session, but because it is not serializable, the session can no longer be replicated.

public class DataGlob {
   String globName;
   String globValue;

   public void addToSession(HttpSession session) {
     session.setAttribute("glob", this);
   }
}

Fixed Code Sample

//The java.io.Serializable class serializes the session attribute. 

public class DataGlob implements java.io.Serializable {
   String globName;
   String globValue;

   public void addToSession(HttpSession session) {
     session.setAttribute("glob", this);
   }
}

https://cwe.mitre.org/data/definitions/579.html https://www.owasp.org/index.php/Top_10-2017_A2-Broken_Authentication