Volodymyr Siedlecki created MYFACES-4721:
--------------------------------------------
Summary: Revisit MYFACES-4659 - Update AUTOCOMPLETE_OFF_VIEW_STATE
Defaults
Key: MYFACES-4721
URL: https://issues.apache.org/jira/browse/MYFACES-4721
Project: MyFaces Core
Issue Type: Bug
Affects Versions: 4.1.1, 4.0.3, 2.3.11, 3.0.2
Reporter: Volodymyr Siedlecki
The defaults for AUTOCOMPLETE_OFF_VIEW_STATE were changed in MYFACES-4659.
However there was further discussion via
[https://github.com/eclipse-ee4j/mojarra/issues/5577]
Firefox still behaves differently unless autocomplete=off is added. For
testing, this vaniila HTML can be used:
{code:java}
<form><input type=hidden name="test" value="original"></form>
<button id=show>show hidden value</button><button
id=update>Update value</button>
<script>document.getElementById("show").addEventListener("click", () => {
alert(document.querySelector("input").value) });
document.getElementById("update").addEventListener("click", () => {
document.querySelector("input").value = "updated" })</script> {code}
BalusC mentioned that using autocomplete="one-time-code" is functionally
equivalent, while still providing valid HTML. Only caveat is that this value is
only supported on newer browsers.
The new proposal:
For 4.0 and earlier, we’ll use autocomplete=off as default (just as before) and
add one-time-code as a new option. This would allow users to have valid HTML if
they wanted to but with the caveat that one-time-code is only supported in new
browsers. Also potentially avoids breaking any users who upgrade to newer
releases.
For 4.1, we’ll make one-time-code as the default but still allow users to
select on / off as values.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
