Java封装困惑

Question

对封装有疑问，不知道这是否是一个愚蠢的问题，但无法找到答案，如果我有一个序列化的 pojo 类，并通过网络传递，有人可以轻松破解该对象并通过 setter 方法更改其状态，所以我的情况是封装实际上如何从外部系统隐藏数据？

例如

    class TestSeralize implement Serializable{
//some setter
    }
test=new TstSeralize();// passed over network.

//hack test by middleman attack & reset through setter

Answer 1

封装的目的是什么？

Encapsulation is the technique of making the fields in a class private and providing access to the fields via public methods.

If a field is declared private, it cannot be accessed by anyone outside the class, thereby hiding the fields within the class. For this reason, encapsulation is also referred to as data hiding.

封装不限制调用公共(public)setter/getter。您必须使用其他技术，例如加密、安全 token 等来检查流中间所做的任何更改。

请查看以下链接

• Signing Java Objects for Secure Transfer

• Secure Coding Guidelines for Java SE