[MYFACES-164] Server-side state should be held

• Type: Improvement
• Status: Closed
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 1.0.9m9
• Fix Version/s: 1.1.2
• Environment: WindowsXP SP2;J2SE1.4.2_07;Tomcat4.1.31
• Assignee: Unassigned
• Reporter: yamo
• Created: 05/Apr/05 13:30
• Updated: 17/Apr/06 20:57
• Resolved: 18/Oct/05 22:11

Description

"When I navigate back to a form that has previously been submitted, using the browser back button, I need to click the submit button twice in order for the form to actually resubmit".
In the mailing list (myfaces-user at 15 Nov 2004), Manfred said "This problem does not exist for client-side state saving".
To be sure, it seems work correctly, but client-side state saving have security problems.
Client-side state is non encrypted data, so users can see the state, and tamper with it.
It is necessary to hold sever-side state like JSF-RI 1.1_01 to use MyFaces for secure application.

Issue Links

• is duplicated by: MYFACES-32 Multiple browser window problem with server state saving
• relates to: MYFACES-543 Problems handling simultaneous request from the same session