I am just a Kryonet user.
The direction of communication from client to server, server to client etc is irrelevant. This problem is that you can not input raw data into sendTCP. It will cause Kryo's class filtering to be ignored. Classes can be registered with Kryo # register (). That limits the classes that can communicate. In Kryonet 's API design, there is a trade - off between security and performance.
The solution is probably something like this. A class called KryonetMessage is needed for Kryonet. KryonetMessage has Kryo inside, receives the Object class and serializes it. Class filtering is done in KryonetMessage setup. Methods like sendTCP (Object o) should be deprecated. There should be only methods like sendTCP (KryonetMessage m). KryonetMessage m is used in many sendTCP (). This solution combines security and performance. However, the API gets a bit dirty. I think that it is an acceptable range.