JSF 2.0 ViewExpiredException on Glassfish 3.1 when using iframe in Safari

Question

I have a JSF 2.0 web application running on glassfish 3.1 that is working fine on IE, FF, Safari and Chrome.

When I added the url of my website inside a iframe of an

Answer 1

I experienced the same issue for IE and Safari. This is because third party cookies are not allowed by default in those browsers. Thus session id could not be passed via cookie.

To fix it in IE is enough to add response header P3P with value CP="This site does not have a p3p policy.":

ExternalContext extContext = FacesContext.getCurrentInstance().getExternalContext();
extContext.addResponseHeader("P3P", "CP=\"This site does not have a p3p policy.\"");

To fix it in Safari is enough to transfer session id in url but not in cookie. This is known as url rewriting. For application server supporting Servlet 3.0 it could be done using web.xml :

    URL