424682 Session cannot be deserialized with form authentication

1 files changed, 5 insertions, 2 deletions

diff --git a/jetty-security/src/main/java/org/eclipse/jetty/security/AbstractUserAuthentication.java b/jetty-security/src/main/java/org/eclipse/jetty/security/AbstractUserAuthentication.java
index ab20ba85ab..d94d57b3e8 100644
--- a/jetty-security/src/main/java/org/eclipse/jetty/security/AbstractUserAuthentication.java
+++ b/jetty-security/src/main/java/org/eclipse/jetty/security/AbstractUserAuthentication.java
@@ -18,6 +18,7 @@
 
 package org.eclipse.jetty.security;
 
+import java.io.Serializable;
 import java.util.Set;
 
 import org.eclipse.jetty.server.Authentication.User;
@@ -30,10 +31,12 @@ import org.eclipse.jetty.server.UserIdentity.Scope;
  *
  * Base class for representing an authenticated user.
  */
-public abstract class AbstractUserAuthentication implements User
+public abstract class AbstractUserAuthentication implements User, Serializable
 {
+    private static final long serialVersionUID = -6290411814232723403L;
     protected String _method;
-    protected UserIdentity _userIdentity;
+    protected transient UserIdentity _userIdentity;
+    
     
     
     public AbstractUserAuthentication(String method, UserIdentity userIdentity)