[jira] [Created] (MYFACES-4721) Revisit MYFACES-4659 - Update AUTOCOMPLETE_OFF_VIEW_STATE Defaults

["Volodymyr Siedlecki (Jira)" <de...@myfaces.apache.org>]

Volodymyr Siedlecki created MYFACES-4721:
--------------------------------------------

             Summary: Revisit MYFACES-4659 - Update AUTOCOMPLETE_OFF_VIEW_STATE Defaults
                 Key: MYFACES-4721
                 URL: https://issues.apache.org/jira/browse/MYFACES-4721
             Project: MyFaces Core
          Issue Type: Bug
    Affects Versions: 4.1.1, 4.0.3, 2.3.11, 3.0.2
            Reporter: Volodymyr Siedlecki


The defaults for AUTOCOMPLETE_OFF_VIEW_STATE were changed in MYFACES-4659.

However there was further discussion via [https://github.com/eclipse-ee4j/mojarra/issues/5577]

Firefox still behaves differently unless autocomplete=off is added.  For testing, this vaniila HTML can be used:
{code:java}
      <form><input type=hidden name="test" value="original"></form>
      <button id=show>show hidden value</button><button
         id=update>Update value</button>
      <script>document.getElementById("show").addEventListener("click", () => { alert(document.querySelector("input").value) }); document.getElementById("update").addEventListener("click", () => { document.querySelector("input").value = "updated" })</script> {code}

BalusC mentioned that using autocomplete="one-time-code" is functionally equivalent, while still providing valid HTML. Only caveat is that this value is only supported on newer browsers. 

The new proposal: 
For 4.0 and earlier, we’ll use autocomplete=off as default (just as before) and add one-time-code as a new option. This would allow users to have valid HTML if they wanted to but with the caveat that one-time-code is only supported in new browsers. Also potentially avoids breaking any users who upgrade to newer releases.

For 4.1, we’ll make one-time-code as the default but still allow users to select on / off as values.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)