code: private void checkSerialize(final HttpServletRequest request) {
      String reqpar = request.getParameter("serialize");
  
      if (reqpar == null) {
        return;
      }
  
      HttpSession sess = request.getSession(false);
      Enumeration en = sess.getAttributeNames();
  
      while (en.hasMoreElements()) {
        String attrname = (String)en.nextElement();
        ObjectOutputStream oo = null;
  
        info("Attempt to serialize attr " + attrname);
        Object o = sess.getAttribute(attrname);
  
        try {
          ByteArrayOutputStream bo = new ByteArrayOutputStream();
          oo = new ObjectOutputStream(bo);
          oo.writeObject(o);
          oo.flush();
  
          info("Serialized object " + attrname + " has size: " + bo.size());
        } catch (Throwable t) {
          t.printStackTrace();
        } finally {
          if (oo != null) {
            try {
              oo.close();
            } catch (Throwable t) {}
          }
        }
      }
    }
docs: /* Debugging routine to see if we can serialize the session.
  We see session serialization errors in the web container if an
  unserializable object class gets embedded in the session somewhere