At JSF: What is the best way to prevent form falsification?

Question

We are using JSF 1.x with server state preservation enabled. We have a problem where an attacker implemented as a web bot can send a page without sending all the fields that are expected to be in the form. This causes some validators not to be called, which should be called, etc.

We would like users to not be able to add / remove fields from the form and submit the form (if they want to submit the form, all the most expected fields will be there). I used to do this using the MD5 hash of the field IDs on the page plus an unknown phrase stored as a hidden field on the page, and a session filter that generates the expected hash based on the field IDs that were sent and compares them with the value in the hidden field.

Is there anything I can do out of the box with JSF so that the user cannot manipulate the form? Or with a third-party library?

Answer 1

JSF 1.x , required="true". / bean, .

, , required="true" (, , , , required="#{not empty param.foo}" , / param.foo). , - / .

, . webbot , , (?) / JSF impl/version, webapp. JSF 1.x .

---

: JSF 2.x, Validator, - JSF? , JSF 2.x, ( ) , bean DB.