Getting ViewExpiredException in clustered environment while state saving method is set to client and user session is valid

by

This will happen if the client side state is encrypted by one server and decrypted by other server and the servers don’t use the same AES key for this. Normally, you should also have seen below warning in server log:

ERROR: MAC did not verify

You need to ensure that you have set jsf/ClientSideSecretKey in web.xml with a fixed AES key, otherwise each server will (re)generate its own AES key during startup/restart (which is used during encrypting view state).

<env-entry>
    <env-entry-name>jsf/ClientSideSecretKey</env-entry-name>
    <env-entry-type>java.lang.String</env-entry-type>
    <env-entry-value>[AES key in Base64 format]</env-entry-value>
</env-entry>

You can use this snippet to generate a random AES256 (32bit) key in Base64 format.

KeyGenerator keyGen = KeyGenerator.getInstance("AES");
keyGen.init(256); // Use 128 for 16bit key.
String key = Base64.getEncoder().encodeToString(keyGen.generateKey().getEncoded());
System.out.println(key); // Prints AES key in Base64 format.

In case you get Java Security: Illegal key size or default parameters? error, install the cryptography extension as instructed in the link, or else generate a random AES128 (16bit) key instead.

After having the key, make absolutely sure you don’t publish/opensource your key.

Further you also need to ensure you have added <distributable /> tag to web.xml so JSF will perform more agressive session dirtying and the HTTP sessions (including view scoped beans themselves!) are properly synced across servers.

Another probable cause of ViewExpiredException with client side state saving is that you’ve set the Mojarra-specific context param com.sun.faces.clientStateTimeout in web.xml which represents the time in seconds before an incoming client side state is considered expired. This is however unlikely the case here as that context param has a rather self-explaining name which you would have spotted by just glancing over web.xml.

See also:

More Related Contents:

  1. javax.faces.application.ViewExpiredException: View could not be restored
  2. How to install and use CDI on Tomcat?
  3. Pass an object between @ViewScoped beans without using GET params
  4. How to upload file using JSF 2.2 ? Where is the saved File?
  5. Which XML namespace to use with JSF 2.2 and up
  6. com.sun.faces.numberOfViewsInSession vs com.sun.faces.numberOfLogicalViews
  7. File upload doesn’t work with AJAX in PrimeFaces 4.0/JSF 2.2.x – javax.servlet.ServletException: The request content-type is not a multipart/form-data
  8. @ViewScoped bean recreated on every postback request when using JSF 2.2
  9. When using @EJB, does each managed bean get its own @EJB instance?
  10. How to handle session expiration and ViewExpiredException in JSF 2?
  11. How to write a file to resource/images folder of the app?
  12. Using a “Please select” f:selectItem with null/empty value inside a p:selectOneMenu
  13. Fileupload and PrettyFaces and JSF 2.2 [duplicate]
  14. javax.faces.INTERPRET_EMPTY_STRING_SUBMITTED_VALUES_AS_NULL does not work anymore since Java EE 7 / EL 3.0
  15. Removing specific CDI managed beans from session
  16. JSF: Mojarra vs. OmniFaces @ViewScoped: @PreDestroy called but bean can’t be garbage collected
  17. Process f:viewParam only on page load
  18. Populate p:selectOneMenu based on another p:selectOneMenu in each row of a p:dataTable
  19. JSF Controller, Service and DAO
  20. When should I use h:outputLink instead of h:commandLink?
  21. Retaining GET request query string parameters on JSF form submit
  22. Trying to understand immediate=”true” skipping inputs when it shouldn’t
  23. How to use in or to select multiple items?
  24. JPA Entity as JSF Bean?
  25. How to make number input area initially empty instead of 0 or 0.00?
  26. Naming Container in JSF2/PrimeFaces [duplicate]
  27. How to add tooltip to f:selectItems
  28. JSF + PrimeFaces: `update` attribute does not update component
  29. action is only invoked on second click
  30. Accessing properties file in a JSF application programmatically

Leave a Comment