Check again. At some point your application is attempting to place a non-serializable object in the HttpSession.
For an object to be truely serialiable (ie for it to serialize without error) then it must be marked Serializable
and not contain any non-static or non-transient references to objects that are not serializable. Did that make sense???
BTW, the problem might not be in one of
your classes, maybe somewhere a standard
Java class which is not serializable (such as a java.sql.Connection) is being added to the HttpSession. You might want to register an HttpSessionAttributeListener to output the type of every object added to an HttpSession and whether or not it implements Serializable. This might help in identifying the cause of your problems.