The pattern of using ObjectInputStream.readFields() ( returns a GetField ) to read the deserialized stream's fields, and validate them before assigning to the object's fields does not work with final fields.

This bug has been filed to investigate the possibility of adding a new field access API to support setting final fields in readObject.