https://stackoverflow.com/questions/18413874
italiano
english
français
española
中国
日本の
العربية
Deutsch
한국어
Português
RussianThe solution is simple: just do not declare non-serializable instances as a property of a serializable class. Session scoped beans needs to be serialize because they can be stored on harddisk (e.g. on a server with low memory profile) and/or transferred over network (e.g. on a server cluster). However, an object which represents a "connection" clearly can't be serialized as such a thing simply can't be passivated.
You need to rewrite your session scoped bean as such that those things are created and destroyed in the method local scope, i.e. entirely inside the method block. It should never leave the method, at least not into the public scope (private static helper methods are okay).
So, just move the three declarations of oauthOperations, connectionFactory and fbUserSession to inside the facebookLogin() method and do not ever pass them outside.
public void facebookLogin() {
OAuth2Operations oauthOperations = connectionFactory.getOAuthOperations();
FacebookConnectionFactory connectionFactory = new FacebookConnectionFactory("MY_KEY", "MY_SECRET");
Facebook fbUserSession = null;
// ...
Another cause is that you manually placed fbUserSession in the HTTP session for some unclear reason. You should not do that. The fbUserSession represents a session wherein you can let your code interact with FB. But this can't be kept open after the method finishes. It has to be closed and reopened upon a new HTTP request. It does not represent a HTTP session orso. You should instead extract the desired information from FB session and then store that information (usually, in flavor of String, Integer, etc, if necessary wrapped in another bean) in session instead. Or even just assign that as a property of the current session scoped bean.
