8

We have client state saving turned on and use ViewScoped backing beans. When client state saving is turned on and we are using a ViewScoped bean, is the ViewScoped bean serialzied to the page or is it say, stored in session with a token/key that is serialized to the page (so that the page can recall the bean from session if the page is posted-back to itself)

A concern here might be that, if it is serialized, then we might want to then worry about not storing large instance variables on the ViewScoped bean as it is serialized to the page and goes back/forth over the wire.

BalusC
  • 992,635
  • 352
  • 3,478
  • 3,452
BestPractices
  • 12,101
  • 27
  • 90
  • 134

2 Answers2

9

When client state saving is turned on and we are using a ViewScoped bean, is the ViewScoped bean serialzied to the page or is it say, stored in session with a token/key that is serialized to the page?

Mojarra 2.x stores view scoped beans in HTTP session. There is an undocumented setting which has a default maximum of 25 view scoped beans in session. See also issue 4015. In other words, the physical view scoped bean instances are never stored in JSF view state. They are only referenced by an UUID which in turn is stored in the JSF view state. So, they are not serialized in the JSF view state, regardless of the client/server state saving method.

A concern here might be that, if it is serialized, then we might want to then worry about not storing large instance variables on the ViewScoped bean as it is serialized to the page and goes back/forth over the wire.

This is a valid concern. Even it were true, we're however talking about rather extreme cases. A collection of 100 average entities with each 10 average properties should already be no more than an additional ~5KB on the view state size. Note that you can get a lot bandwidth back by enabling gzip compression on the webserver, even up to 70% per text based resource.

If you're however dealing with large data, then the HTTP session storage size may in turn become a concern. See also JSF 2.2 Memory Consumption: Why does Mojarra keep the ViewScoped Beans of the last 25 Views in Memory? Ideally, the view scoped bean should just be destroyed as soon as the page it is referencing is unloaded by a GET navigation or browser tab close. The default JSF view scoped bean doesn't do that. It's only destroyed during a postback to a different view, or when the session expires.

In case you happen to use the JSF utility library OmniFaces, since version 2.2 the @org.omnifaces.cdi.ViewScoped supports being destroyed during an unload. This should have a positive effect on HTTP session storage size.

Community
  • 1
  • 1
BalusC
  • 992,635
  • 352
  • 3,478
  • 3,452
  • Thanks-- this is great info to know. – BestPractices May 09 '12 at 14:34
  • Adding to this great answer: you can additionally encrypt the client rendered viewstate. I think this will even be the default in JSF 2.2 – Mike Braun May 09 '12 at 18:14
  • 1
    @Mike: indeed, on Mojarra by a JNDI entry `com.sun.faces.ClientStateSavingPassword`, see also [Glassfish wiki](https://wikis.oracle.com/display/GlassFish/JavaServerFacesRI#JavaServerFacesRI-HowcanIsecureviewstatewhenusingclientsidestatesaving%3F). On JSF 2.2 this is part of [CSRF protection by specification](http://jdevelopment.nl/jsf-22/#869). – BalusC May 09 '12 at 18:19
  • @BalusC: just a word of caution, I believe the name of the JNDI entry changes depending on the version of Mojarra. Sometimes it is `com.sun.faces.ClientStateSavingPassword` as you stated, sometimes it is just `ClientStateSavingPassword`. I have filed a JIRA here: http://java.net/jira/browse/JAVASERVERFACES-1214 – Richard Kennard Oct 29 '12 at 03:52
  • @balusC: when these veiwscoped beans are serialized to page (with client side saving), then why are the viewscoped beans lost after session destroy. How would JSF websites deal with this scenario when user is inactive for some period, session is destroyed on server, & then he returns & interacts with a previously opened pages, whose viewdata is lost? (Here is the complete question.. http://stackoverflow.com/questions/21643250/how-to-survive-viewscoped-beans-viewmap-after-session-destroy-using-client-side) – Rajat Gupta Feb 10 '14 at 19:22
  • After all, sessions on server cannot be expected to be kept for unlimited time intervals.. to keep the viewscoped data alive – Rajat Gupta Feb 10 '14 at 19:24
3

Please note that the answer by BalusC is not true for recent versions of JSF: for recent versions the data of the javax.faces.view.ViewScoped beans is kept on the server. See JAVASERVERFACES-3090

Leo Mekenkamp
  • 208
  • 2
  • 7