3

I tested new Flash scope in JSF2 but I found a major issue with it or I am lacking some knowledge.

Having a page:

<h:body>
    Value in flash: #{flash.text}
    <h:form>    
         <h:inputText value="#{flash.text}" />
         <h:commandButton value="Test" /> <!-- Same behavior with faces redirect -->
    </h:form>
</h:body>

I have a scenario:

  • Put a value 'foo' and click Test
  • I get 'Value in flash: foo'
  • I open new page with the same adress
  • I get 'Value in flash:'
  • I open another new page with the same adress
  • I get 'Value in flash: foo' <- IMHO this is wrong!

Reproducibility: 100% Tested on Glassfish 3.1 and JBoss AS 7

Different problem with probably same reason: Removing JSF messages from the flash

So:

  • Is it desired behavior of JSF2 flash?
  • Based on this and other noticed problems with flash, shoud the reference flash implementation be considered harmful?
Community
  • 1
  • 1
Krzysiek
  • 31
  • 3
  • Workaround: Usually when one would like to use Flash, one should use e.g. Seam 3 [RenderScope](http://docs.jboss.org/seam/3/faces/latest/reference/en-US/html/scopes.html#RenderScoped) – Krzysiek Jul 15 '11 at 14:28
  • It is not the case with Jetty8 I have tried in it. – deepmoteria Jul 04 '12 at 05:17

1 Answers1

2

I think for now the implementation of The Flash should be considered harmful indeed. In the application I'm working on day to day I had a very good use case for it, but unfortunately The Flash just appeared to be unusable.

The main problem is that the cookie which is used to transfer a pointer to the state isn't cleared, see Flash scoped message lives longer than next request.

There also seems to be a security problem with the flash scope, see Flash scope cookie enables data exploits.

If any of this bothers you, please vote for the linked issues ;)

Arjan Tijms
  • 37,782
  • 12
  • 108
  • 140
  • Thanks. Does [RenderScope](http://docs.jboss.org/seam/3/faces/latest/reference/en-US/html/scopes.html#RenderScoped) can replace Flash in your use case? – Krzysiek Aug 08 '11 at 09:32
  • Yes, this seems to be able to do the trick. My use case is a very classic redirect-after-post scenario, where the redirected page simply needs to display a message. An additional bonus is that there is a provision to generate an ID for any context other than the first one in case there are multiple ones active. – Arjan Tijms Aug 08 '11 at 19:17