Am 09.01.15 um 11:58 schrieb Dan Østerberg:
Hi,
We have a JSF application where we mainly use ViewScoped beans, and add no-cache headers
for all JSF pages. Navigating back to a previous page correctly recreates the beans, and
renders new HTML, with a new ViewState ID. But... some browsers "autocomplete"
some of the hidden ViewState inputs, overriding the new value with an old ViewState
value. We have verified this in the browser dev-tools by looking at the response, which
is correct, and the resulting HTML which is not.
In short, this is a known autocomplete issue, which Mojarra has fixed since 1.2, by adding
'autocomplete="off"' to the hidden ViewState input. Plus a context parameter
"com.sun.faces.autoCompleteOffOnViewState" for opting not to use it, since it results in invalid
XHTML. Adding 'pa:autocomplete="off"' explicitly to the whole form also fixes this issue. However,
at least the MyFaces version that we use (2.2.4) doesn't add this attribute, and doesn't seem to have any
corresponding configuration either. We also failed to google up alternatives/explanations for this issue
explicitly in MyFaces. Naturally, we would like to avoid javascript hacks and custom components and renderers.
So the question is - are we missing something? Or should MyFaces be patched to simply
render 'autocomplete="off"' for its hidden javax.faces.ViewState inputs?
Thanx,
Dan Østerberg
Hi this looks like a bug to me, please file a bugreport in the MyFaces
Bugtracker.
https://issues.apache.org/jira/browse/myfaces
Kind regards
Werner Punz
