[
https://issues.apache.org/jira/browse/MYFACES-4309?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16969535#comment-16969535
]
Bill Lucy commented on MYFACES-4309:
------------------------------------
Ok, I've updated [https://github.com/apache/myfaces/pull/71] : it adds
RenderResponseExecutor.forceSessionCreation(), which checks for a new prop
ALWAYS_FORCE_SESSION_CREATION || (view != transient && stateSaving != client)
and creates a session. I've left out checking for scopes as I'm hoping
ALWAYS_FORCE_SESSION_CREATION can better cover that case.
Which brings up a question about ALWAYS_FORCE_SESSION_CREATION: should we
default it to true? My interpretation of 4297 is that it's more of
long-standing bug than a security concern, so I don't think we should have
changed our behavior in 2.2 and 2.3 in such a way that existing apps are
required to update their config. It then makes sense to default
ALWAYS_FORCE_SESSION_CREATION=false in 3.0.
> Session is broken in some cases due to MYFACES-4297
> ---------------------------------------------------
>
> Key: MYFACES-4309
> URL: https://issues.apache.org/jira/browse/MYFACES-4309
> Project: MyFaces Core
> Issue Type: Bug
> Affects Versions: 2.3.5
> Reporter: Bill Lucy
> Assignee: Bill Lucy
> Priority: Major
> Time Spent: 10m
> Remaining Estimate: 0h
>
> The changes made for MYFACES-4297 introduced a problem: in some cases a
> session is not created early enough for a session cookie to be written out on
> a response before it is committed, due to the small default response buffer
> size. As mentioned in the comments for 4297, that behavior causes a problem
> for the ViewScope (and I expect the session as well.)
> As discussed, increasing the javax.faces.FACELETS_BUFFER_SIZE is a
> workaround, but that's not ideal for a few reasons:
> 1. apps using the default buffer size value will be broken by the new
> behavior when updating to 2.3.5
> 2. there doesn't appear to be a way to update the buffer size for JSPs
> We should consider revisiting the changes made in MYFACES-4297. Or, if
> nothing else, we might want to add some way to change the default buffer size
> on the JSP path.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
