Implications of saving session on the client with javax.faces.STATE_SAVING_METHOD

My first JSF page was throwing javax.faces.application.ViewExpiredException. while I searched I got this solution which solved my problem.

<context-param>
    <param-name>javax.faces.STATE_SAVING_METHOD</param-name>
    <param-value>client</param-value>
</context-param>

But I am concerned about the security implication.

BalusC

This doesn't save the "session" in client side at all.

This only saves the JSF view state in client side. This is in JSF 2.2 always AES-encrypted with a key which is generated on application startup. This however invalidates once you restart the application, hereby causing all existing view states to become invalid. You can specify a fixed key as below in web.xml so that all existing view states keep valid across server restarts:

<env-entry>
    <env-entry-name>jsf/ClientSideSecretKey</env-entry-name>
    <env-entry-type>java.lang.String</env-entry-type>
    <env-entry-value>[AES key in Base64 format]</env-entry-value>
</env-entry>

You can use this page to generate a random AES key in Base64 format.

Implications of saving session on the client with javax.faces.STATE_SAVING_METHOD

See also: