myfaces-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Leonardo Uribe <>
Subject Re: javax.faces.ViewState autocomplete
Date Wed, 14 Jan 2015 00:47:39 GMT

Yes, it could be considered a bug. But it looks strange to set it on a
hidden field. Anyway, the argumentation is solid, so please create an
issue. It could be great if you can say in which browsers this
behavior happens.


Leonardo Uribe

2015-01-13 14:31 GMT-05:00 Werner Punz <>:
> Am 09.01.15 um 11:58 schrieb Dan Østerberg:
>> Hi,
>> We have a JSF application where we mainly use ViewScoped beans, and add
>> no-cache headers for all JSF pages. Navigating back to a previous page
>> correctly recreates the beans, and renders new HTML, with a new ViewState
>> ID. But... some browsers "autocomplete" some of the hidden ViewState inputs,
>> overriding the new value with an old ViewState value. We have verified this
>> in the browser dev-tools by looking at the response, which is correct, and
>> the resulting HTML which is not.
>> In short, this is a known autocomplete issue, which Mojarra has fixed
>> since 1.2, by adding 'autocomplete="off"' to the hidden ViewState input.
>> Plus a context parameter "com.sun.faces.autoCompleteOffOnViewState" for
>> opting not to use it, since it results in invalid XHTML. Adding
>> 'pa:autocomplete="off"' explicitly to the whole form also fixes this issue.
>> However, at least the MyFaces version that we use (2.2.4) doesn't add this
>> attribute, and doesn't seem to have any corresponding configuration either.
>> We also failed to google up alternatives/explanations for this issue
>> explicitly in MyFaces. Naturally, we would like to avoid javascript hacks
>> and custom components and renderers.
>> So the question is - are we missing something? Or should MyFaces be
>> patched to simply render 'autocomplete="off"' for its hidden
>> javax.faces.ViewState inputs?
>> Thanx,
>> Dan Østerberg
> Hi this looks like a bug to me, please file a bugreport in the MyFaces
> Bugtracker.
> Kind regards
> Werner Punz

View raw message