The browser is following the HTML 4.0.1 spec:
A successful control is "valid" for submission.
...elided text...
- Controls that are disabled cannot be successful.
Disabled form controls are not submitted as part of the form.
As an additional security measure the JSF component renderer should not process the value in the Apply Request Values phase if it finds isDisabled() == true
.
From the HTML render kit doc:
If a Renderer chooses to implement decode behavior, it must consult the "disabled" and "readonly" attributes of the component to be rendered, if the value of either attribute is equal to, ignoring case, the string "true" (without the quotes) the decode method must take no action and return immediately.
Since the Apply Request Values phase runs first, evaluation of these booleans cannot be affected by anything in your form submission (unless you bind them to #{param.foo}
expressions - beware of any security considerations).
Your form design and submission strategy must take these constraints into account.