JSF reset backing beans when back is pressed RequestScoped

Question

I have a simple webapplication in which user can create other users with roles, what i want for security purposes is that after user(Admin Role) created another user it goes to welcome page and when user presses back button in a web browser, User can see all the values inside input text box i want to reset input text box's values when user press back OR the previous page expires when user presses back button

Thanks.

If the bean is `@RequestScoped` you should have no problems, since the bean stores information only for requests. However, are you sure the problem isn't about your browser reminding form values? — Aritz, Oct 03 '13 at 08:06
Well even if my browser caching from values it must reset the bean when back button is pressed from the browser or atleast gives session expired message. — GhousKhan22, Oct 03 '13 at 08:11
As I say, if the bean is request scoped, then its lifecycle is only for one request. Bean values are set during form sending, so bean doesn't aqcuire form values at all when user is entering them, till he press submit button. So pressing back button will undo everything. — Aritz, Oct 03 '13 at 08:16
Yes after submitting the values when user press back it shows all the values even though its not getting it from server side. — GhousKhan22, Oct 03 '13 at 09:17

score 2 · Accepted Answer · edited May 23 '17 at 12:22

2

You need to turn browser's autocomplete off. That's done using autocomplete attribute in your form inputs:

<h:form>
    <h:inputText value="#{auth.username}" required="true" autocomplete="off" />
    <h:inputSecret value="#{auth.password}" required="true" autocomplete="off" />
    <h:commandButton value="Login" action="#{auth.login}" />
    <h:messages />
</h:form>

Have a look at this.

edited May 23 '17 at 12:22

Community

1
1

answered Oct 03 '13 at 09:27

Aritz

30,971
16
136
217

score 0 · Answer 2 · answered Oct 03 '13 at 09:19

First of all you should use filters for security. In your filters, you can set headers of your response. this will be handle your security issues. a simple implementation will be like that :

import javax.servlet.*;
import javax.servlet.annotation.WebFilter;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

@WebFilter(urlPatterns = {"yourUrlThatWillbeProtected"})
//you should also put dispatcherTypes in webFilter
public class PageFilter implements Filter {


public void init(FilterConfig filterConfig) throws ServletException {

}


public void doFilter(ServletRequest request, ServletResponse response,
                     FilterChain chain) throws IOException, ServletException {


        //do some filtering , take user, check user, etc.

        HttpServletResponse res = (HttpServletResponse) response;
        // security of closed pages
        res.setHeader("Cache-Control", "no-cache, no-store, must-revalidate"); // HTTP 1.1.
        res.setHeader("Pragma", "no-cache"); // HTTP 1.0.
        res.setDateHeader("Expires", 0); // Proxies.
        chain.doFilter(request, response);


}

@Override
public void destroy() {
}
 }

Thanks it works, on IE 8 and Firefox but not working on Chrome — GhousKhan22, Oct 03 '13 at 11:24

JSF reset backing beans when back is pressed RequestScoped

2 Answers2