h:commandLink and unsafe-inline

Question

If you look at this Mkyong example of how h:commandLink is resolved, it looks like this.

//JSF
<h:commandLink action="#{user.goLoginPage}" value="Login page + Param ">
    <f:param name="username" value="mkyong" />
</h:commandLink>

//HTML output
<script type="text/javascript"
 src="/JavaServerFaces/faces/javax.faces.resource/jsf.js?ln=javax.faces&stage=Development">
</script>

<a href="#"
    onclick="mojarra.jsfcljs(document.getElementById('j_idt6'),
    {'j_idt6:j_idt20':'j_idt6:j_idt20','username':'mkyong'},'');
    return false">
    Login page + Param
</a>

The problem with this is that if you are enforcing unsafe-inline your browser will refuse to execute this.

I've been whitelisting inline scripts with the nonce method.

Is there a way to allow the h:commandLinks to work?

score 3 · Accepted Answer · edited Jun 20 '20 at 09:12

There is in HTML no way to perform a POST request using an <a> element. JSF in this context being just a HTML code generator can't do much about that.

You have 3 options:

Replace by <h:commandButton>.
Or, replace by <h:link>.
Or, replace by a custom component which initializes the script externally.

h:commandLink and unsafe-inline

1 Answers1

See also: