@Override
    protected Serializable internalDeserializeFromBytes(final byte[] bytes) {
        Serializable o = null;
        try (val bais = new ByteArrayInputStream(bytes);
             ObjectInputStream ois = new RestrictedObjectInputStream(bais, this.trustedPackages, this.trustedClasses)) {
            o = (Serializable) ois.readObject();
        } catch (final IOException | ClassNotFoundException e) {
            LOGGER.warn("cannot Java deserialize object", e);
        }
        return o;
    }
{@inheritDoc}

Deserialize a bytes array into a Java object.
pac4j-core/src/main/java/org/pac4j/core/util/serializer/JavaSerializer.java