Firefox overrides javax.faces.ViewState with old value on F5, how to turn off autocomplete

Question

I am using JSF 2.1 on Tomcat 7 and opening it in Firefox 23.0.0.1.

The page generates a javax.faces.ViewState hidden input field as expected:

<input type="hidden" value="2442695108697186454:-4079620282104128276" id="javax.faces.ViewState" name="javax.faces.ViewState">

When hitting F5, the server sends a new id for javax.faces.ViewState, which is correct. However, Firefox keeps the old value in the hidden input. The result is that the old view-scoped bean is taken on ajax requests.

Only when I force a hard refresh by Strg/Ctrl+F5, then Firefox takes the new value from server. I think it's a feature of Firefox (I often see when reloading a page with a form Firefox keeps my inputs).

Any ideas how to deal with that? I think it's related to Preventing Firefox from remembering the input value on refresh with Meta tag, but how do I put autocomplete="off" on this JSF-generated hidden input component?

Answer 1

Mojarra adds already by default autocomplete="off" to the view state hidden field since version 1.2. Apparently your webapplication is configured to disable it because the developers were fearing the W3 HTML validator for some reason, or perhaps the HTTP response body is been passed through some overzealous (X)HTML formatting filter. The autocomplete="off" in an <input type="hidden"> is namely invalid in (X)HTML.

Look for the following context parameter in web.xml. If it's present, get rid of it. It defaults to true already.

<context-param>
    <param-name>com.sun.faces.autoCompleteOffOnViewState</param-name>
    <param-value>false</param-value>
</context-param>

Or if you have indeed such a formatting filter, look in its documentation how to tell it to not remove (X)HTML-invalid attributes.

See also:

• Mojarra issue 1129