Is JSF 2.0 View Scope back-button safe?

by

To start, the view scope is bound to a particular page/view. Multiple views won’t share the same view scoped bean. The view scope starts with an initial GET request and stops when a POST action navigates with a non-null return value.

There are in general the following scenarios, depending on whether the browser is instructed to cache the page or not and the JSF state saving configuration. I’ll assume that the navigation between those pages took place by a POST request (as it sounds much like the “Wizard” scenario).

When the back button is pressed:

  • If browser is instructed to save the page in cache, then browser will load the page from the cache. All previously entered input values will reappear from the browser cache (thus not from the view scoped bean in the server side!). The behavior when you perform a POST request on this page depends further on the javax.faces.STATE_SAVING_METHOD configuration setting:
    • If set to server (default), then a ViewExpiredException will occur, because the view state is trashed at the server side right after POST navigation from one to other page.
    • If set to client, then it will just work, because the entire view state is contained in a hidden input field of the form.
  • Or, if browser is instructed to not save the page in cache, then browser will display a browser-default “Page expired” error page. Only when the POST-redirect-GET pattern was applied for navigation, then the browser will send a brand new GET request on the same URL as the redirect URL. All previously entered input values will by default get cleared out (because the view scoped bean is recreated), but if the browser has “autocomplete” turned on (configureable at browser level), then it will possibly autofill the inputs. This is disableable by adding autocomplete="off" attribute to the input components. When you perform a POST request on this page, it will just work regardless of the JSF state saving method.

It’s easier to perform the “Wizard” scenario on a single view which contains conditionally rendered steps and offer a back button on the wizard section itself.

See also:

  • javax.faces.application.ViewExpiredException: View could not be restored
  • What scope to use in JSF 2.0 for Wizard pattern?

Leave a Comment

tech