Re: security hole

[Dennis_Byrne]

> Can <x:saveState> save any information about a backing bean(request
> scope) on server side? when a new backing bean is created, will it
> get the data saved with <x:saveState>? Thanks. Dave

Yes, just place this in your DD.

           <context-param>
        <param-name>javax.faces.STATE_SAVING_METHOD</param-name>
        <param-value>server</param-value>
           </context-param>