The User object should be marked as non-serializable using NonSerializableTrait.
Serializing user objects can drag along large amounts of data. Deserialized user objects may contain stale data. This is the case especially for the following member fields of User:
- mRequest A WebRequest that would be invalid and misleading when deserialized during a later request.
- mBlock, mBlockedFromCreateAccount, $mGlobalBlock:AbstractBlock instances that may be inaccurate at a later time.
This could be mitigated by blanking these fields during serialization. However, User object should generally not be considered safe for serialization. UserIdentityValue should be used instead.
The first attempt to do so caused a production error, see T264363: Instances of User are not serializable!. We need to resolve at least two instances of User being serialized first: