Android 使用 HttpURLConnection 發送 Java 序列化對象實現雙向通信

核心要求

• 雙端共享完全相同的實體類（包名、類名、serialVersionUID、字段）
• 實體類實現 Serializable 並顯式聲明 serialVersionUID
• 請求頭設置 Content-Type: application/x-java-serialized-object

Android 客戶端關鍵代碼

public String sendDataByPost(String urlStr) {
    String result = "";
    try {
        URL url = new URL(urlStr);
        HttpURLConnection conn = (HttpURLConnection) url.openConnection();
        conn.setConnectTimeout(2000);
        conn.setReadTimeout(2000);
        conn.setDoOutput(true);      // 允許輸出
        conn.setDoInput(true);       // 允許輸入
        conn.setUseCaches(false);
        conn.setRequestProperty("Content-Type", "application/x-java-serialized-object");
        conn.setRequestMethod("POST");

        // 序列化寫出
        try (OutputStream os = conn.getOutputStream();
             ObjectOutputStream oos = new ObjectOutputStream(os)) {
            DataPost data = new DataPost("Tom", null);
            oos.writeObject(data);
            oos.flush();
        }

        // 反序列化讀取響應
        if (conn.getResponseCode() == HttpURLConnection.HTTP_OK) {
            try (InputStream is = conn.getInputStream();
                 ObjectInputStream ois = new ObjectInputStream(is)) {
                DataPost resp = (DataPost) ois.readObject();
                result = resp.getPassword();
                Log.w("HTTP", result + " :by post");
            }
        } else {
            Log.w("HTTP", "Connection failed: " + conn.getResponseCode());
        }
    } catch (Exception e) {
        e.printStackTrace();
    }
    return result;
}

實體類 DataPost

public class DataPost implements Serializable {
    private static final long serialVersionUID = 1L;  // 必須雙端一致
    private String name;
    private String password;
    // 構造器、getter/setter...
}

服務端 Servlet doPost

protected void doPost(HttpServletRequest req, HttpServletResponse resp) 
        throws ServletException, IOException {
    try (ServletInputStream in = req.getInputStream();
         ObjectInputStream ois = new ObjectInputStream(in);
         OutputStream out = resp.getOutputStream();
         ObjectOutputStream oos = new ObjectOutputStream(out)) {

        DataPost data = (DataPost) ois.readObject();
        data.setPassword("9964646");  // 業務處理

        resp.setContentType("application/x-java-serialized-object");
        oos.writeObject(data);
        oos.flush();
    } catch (ClassNotFoundException e) {
        throw new ServletException(e);
    }
}

四大避坑指南

1. URL 中文編碼：URI uri = new URI(url, false, "utf-8"); url = uri.toString();
2. 主線程網絡請求崩潰：必須在子線程/AsyncTask/RxJava 中調用
3. 包名必須一致：否則 ClassNotFoundException: com.example.DataPost
4. serialVersionUID 必須一致：否則 InvalidClassException: local class incompatible

現代替代方案

生產環境建議使用 JSON (Gson/Moshi) + OkHttp/Retrofit，跨平台、可讀、調試友好，避免 Java 序列化的脆弱性與安全風險。