myfaces-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Dan Østerberg <...@ren.no>
Subject SV: javax.faces.ViewState autocomplete
Date Wed, 14 Jan 2015 09:51:57 GMT
Hi, and thanx for the support. We've only observed this behavior in Google Chrome. I've registered
a Jira for this: 
https://issues.apache.org/jira/browse/MYFACES-3949

Cheers,
Dan Østerberg

-----Opprinnelig melding-----
Fra: Leonardo Uribe [mailto:lu4242@gmail.com] 
Sendt: 14. januar 2015 01:48
Til: MyFaces Discussion
Emne: Re: javax.faces.ViewState autocomplete

Hi

Yes, it could be considered a bug. But it looks strange to set it on a hidden field. Anyway,
the argumentation is solid, so please create an issue. It could be great if you can say in
which browsers this behavior happens.

regards,

Leonardo Uribe

2015-01-13 14:31 GMT-05:00 Werner Punz <werner.punz@gmail.com>:
> Am 09.01.15 um 11:58 schrieb Dan Østerberg:
>
>> Hi,
>>
>> We have a JSF application where we mainly use ViewScoped beans, and 
>> add no-cache headers for all JSF pages. Navigating back to a previous 
>> page correctly recreates the beans, and renders new HTML, with a new 
>> ViewState ID. But... some browsers "autocomplete" some of the hidden 
>> ViewState inputs, overriding the new value with an old ViewState 
>> value. We have verified this in the browser dev-tools by looking at 
>> the response, which is correct, and the resulting HTML which is not.
>>
>> In short, this is a known autocomplete issue, which Mojarra has fixed 
>> since 1.2, by adding 'autocomplete="off"' to the hidden ViewState input.
>> Plus a context parameter "com.sun.faces.autoCompleteOffOnViewState" 
>> for opting not to use it, since it results in invalid XHTML. Adding 
>> 'pa:autocomplete="off"' explicitly to the whole form also fixes this issue.
>> However, at least the MyFaces version that we use (2.2.4) doesn't add 
>> this attribute, and doesn't seem to have any corresponding configuration either.
>> We also failed to google up alternatives/explanations for this issue 
>> explicitly in MyFaces. Naturally, we would like to avoid javascript 
>> hacks and custom components and renderers.
>>
>> So the question is - are we missing something? Or should MyFaces be 
>> patched to simply render 'autocomplete="off"' for its hidden 
>> javax.faces.ViewState inputs?
>>
>> Thanx,
>> Dan Østerberg
>>
> Hi this looks like a bug to me, please file a bugreport in the MyFaces 
> Bugtracker.
> https://issues.apache.org/jira/browse/myfaces
>
>
> Kind regards
>
> Werner Punz
>
>
Mime
View raw message