all web applications use serialization to do session replication. Now this is safe as the both stream ends are controlled by the developer, and only if they are

all web applications use serialization to do session replication. Now this is safe as the both stream ends are controlled by the developer, and only if they are stupid, (instead of malicious) will there problems. Still if java serialization goes away, this will be the most widespread impacting change in the java ecosphere wrt changing how serialization works.