3

My first JSF page was throwing javax.faces.application.ViewExpiredException. while I searched I got this solution which solved my problem. 

<context-param>
    <param-name>javax.faces.STATE_SAVING_METHOD</param-name>
    <param-value>client</param-value>
</context-param>

But I am concerned about the security implication.

BalusC
  • 1,082,665
  • 372
  • 3,610
  • 3,555
Paullo
  • 2,038
  • 4
  • 25
  • 50

1 Answers1

6

This doesn't save the "session" in client side at all.

This only saves the JSF view state in client side. This is in JSF 2.2 always AES-encrypted with a key which is generated on application startup. This however invalidates once you restart the application, hereby causing all existing view states to become invalid. You can specify a fixed key as below in web.xml so that all existing view states keep valid across server restarts:

<env-entry>
    <env-entry-name>jsf/ClientSideSecretKey</env-entry-name>
    <env-entry-type>java.lang.String</env-entry-type>
    <env-entry-value>[AES key in Base64 format]</env-entry-value>
</env-entry>

You can use this page to generate a random AES key in Base64 format.

See also:

Community
  • 1
  • 1
BalusC
  • 1,082,665
  • 372
  • 3,610
  • 3,555