Let's say we have the “add a new object” form in AddObject.jspx, and the Confirm.jsp page (something like an object with identifier NN was added to the database ...)
in faces-config.xml:
<navigation-rule>
<from-view-id>/AddObject.jsp</from-view-id>
<navigation-case>
<from-outcome>add</from-outcome>
<to-view-id>/Confirm.jsp</to-view-id>
</navigation-case>
</navigation-rule>
Thus, the user opens AddObject.jsp, fills out the form and clicks the Add button, which launches the event handler in the AddObject bean support. Support bean inserts a new object into the database and returns the result "add". Thus, we get to the confirmation screen.
Now, if I press F5 (refresh browser), a new object will be created, and the confirmation screen will be displayed again with the new identifier of the new object. I can continue to attack F5 and get as many new objects as I want.
. . ( , ).
JSF? from-view-id/result/to-view-id, , , ?