Currently, Mifos just uses Java Serialization to store objects in the sessions (HttpSession) provided by the servlet API. The Servlet API says that objects stored in the session are supposed to be serializable. This is so that your web server (jetty/tomcat) can save all the sessions on shutdown and re-read them on startup. Thus, restarting the web server need not require all the users to log back in again.

Java Serialization has mechanisms to write out an object with one version of your program, and read it with a new version (for example, see the serialver command and the serialVersionUID field of serializable classes). If we implemented this, it would mean that someone could upgrade Mifos and not require the users to log out and back in. However, this is extra work and complexity, and our current decision is that it isn't worth it, since the benefit seems small.

See also

Object Serialization at sun.com