# Serialization in .NET

In .NET, serialization is the process of converting an object into a format that can be easily stored or transmitted and later reconstructed back into its original form. .NET provides various mechanisms for serialization, including binary serialization, XML serialization, and JSON serialization. Here’s a breakdown of how serialization is accomplished in .NET.

## **Types of Serialization in .NET**

### **a. Binary Serialization**

* Converts an object into a binary format.
* This method is useful for saving data to files or sending data over networks.
* The `[Serializable]` attribute is required on the class whose objects you want to serialize.

**Example:**

```csharp
using System;
using System.IO;
using System.Runtime.Serialization.Formatters.Binary;

[Serializable]
public class User
{
    public string Username { get; set; }
}

class Program
{
    static void Main()
    {
        User user = new User { Username = "john_doe" };
        
        // Serialization
        using (FileStream fs = new FileStream("user.bin", FileMode.Create))
        {
            BinaryFormatter formatter = new BinaryFormatter();
            formatter.Serialize(fs, user);
        }

        // Deserialization
        using (FileStream fs = new FileStream("user.bin", FileMode.Open))
        {
            BinaryFormatter formatter = new BinaryFormatter();
            User deserializedUser = (User)formatter.Deserialize(fs);
            Console.WriteLine(deserializedUser.Username); // Output: john_doe
        }
    }
}
```

### **b. XML Serialization**

* Converts an object into an XML format.
* Useful for interoperability with systems that use XML.
* The `[XmlRoot]` and `[XmlElement]` attributes are often used to control the XML structure.

**Example:**

```csharp
using System;
using System.IO;
using System.Xml.Serialization;

[XmlRoot("User")]
public class User
{
    [XmlElement("Username")]
    public string Username { get; set; }
}

class Program
{
    static void Main()
    {
        User user = new User { Username = "john_doe" };
        
        // Serialization
        XmlSerializer serializer = new XmlSerializer(typeof(User));
        using (FileStream fs = new FileStream("user.xml", FileMode.Create))
        {
            serializer.Serialize(fs, user);
        }

        // Deserialization
        using (FileStream fs = new FileStream("user.xml", FileMode.Open))
        {
            User deserializedUser = (User)serializer.Deserialize(fs);
            Console.WriteLine(deserializedUser.Username); // Output: john_doe
        }
    }
}
```

### **c. JSON Serialization**

* Converts an object into JSON format.
* Commonly used in web applications, particularly with ASP.NET Core.
* The `System.Text.Json` or `Newtonsoft.Json` libraries can be used for this purpose.

**Example using `System.Text.Json`:**

```csharp
using System;
using System.IO;
using System.Text.Json;

public class User
{
    public string Username { get; set; }
}

class Program
{
    static void Main()
    {
        User user = new User { Username = "john_doe" };
        
        // Serialization
        string jsonString = JsonSerializer.Serialize(user);
        File.WriteAllText("user.json", jsonString);

        // Deserialization
        string jsonFromFile = File.ReadAllText("user.json");
        User deserializedUser = JsonSerializer.Deserialize<User>(jsonFromFile);
        Console.WriteLine(deserializedUser.Username); // Output: john_doe
    }
}
```

## **2. Security Considerations**

* **Insecure Deserialization**: When deserializing data, it’s essential to validate and sanitize input to prevent attacks, such as injecting malicious code that can lead to **Remote Code Execution (RCE)**.
* **Use of `[Serializable]`**: Ensure that only trusted classes are marked with this attribute to avoid unintended exposure.
* **BinaryFormatter Warning**: Starting from .NET 5, the `BinaryFormatter` is considered insecure and should be avoided. Alternatives like JSON or XML serialization are recommended.

## **3. Custom Serialization**

* You can implement the `ISerializable` interface to control the serialization process, allowing you to customize how an object is serialized and deserialized.

**Example:**

```csharp
using System;
using System.IO;
using System.Runtime.Serialization;

[Serializable]
public class User : ISerializable
{
    public string Username { get; set; }

    public User() { }

    protected User(SerializationInfo info, StreamingContext context)
    {
        Username = info.GetString("Username");
    }

    public void GetObjectData(SerializationInfo info, StreamingContext context)
    {
        info.AddValue("Username", Username);
    }
}
```

#### **Conclusion**

Serialization in .NET is a powerful feature that enables easy data storage and transmission. By understanding the different serialization techniques available and the security implications, developers can effectively utilize serialization while maintaining application security.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://sallam.gitbook.io/sec-88/web-appsec/serialization-in-.net.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.