Why doesn’t the XmlSerializer need the type to be marked [Serializable]?

This is because XmlSerializer only serializes public fields/properties. Other forms of serialization can serialize private data, which constitutes a potential security risk, so you have to “opt in” using an attribute.

Leave a Comment