title: How to validate the contents of the object stream before deserializing?
body: <p>We are trying to implement secure application framework and as part of that to avoid denial of service attacks before deserialization we want to achieve how many objects are being deserialized and abort the deserialization when a threshold is surpassed.</p>
  
  <p>TO meet above requirement googled some of the forums and came to know that there are some methods realted to java serialization i.e </p>
  
  <pre><code>resolveClass(ObjectStreamClass desc)
  resolveObject(Object obj)
  </code></pre>
  
  <p>But i didn't get any documentation or examples regarding these two methods.Can somebody post me or give some brief info regarding these methods/custom deserialization</p>