Unless there is a good reason, I’m -1 as well.
Regards,
Cagatay Civici
PrimeFaces Lead
PrimeTek Informatics
www.primefaces.org
On Monday 12 January 2015 at 19:14, Kito Mann wrote:
> -1 I agree with Neil.
>
>
> On Mon, Jan 12, 2015 at 11:58 AM, Neil Griffin <neil.griffin_at_portletfaces.org (mailto:neil.griffin_at_portletfaces.org)> wrote:
> > There are other hidden fields including “javax.faces.encodedURL” and “javax.faces.ClientWindow"
> >
> > And when f:ajax triggers and XHR, there are standard parameters added to the request such as “javax.faces.partial.ajax"
> >
> > If we made the name “javax.faces.ViewState” configurable, wouldn’t we need to make the others configurable too?
> >
> > At this time I think the benefit does not outweigh the drawback.
> >
> > -1
> >
> > > On Jan 12, 2015, at 11:29 AM, arjan tijms <arjan.tijms_at_gmail.com (mailto:arjan.tijms_at_gmail.com)> wrote:
> > > Hi,
> > >
> > > I do agree with the motivation behind the request; indeed, looking for
> > > "ViewState" is basically the first thing I do to discover if a site is
> > > using JSF. In fact, a couple of sites that I suggested for the real
> > > life JSF page were discovered by looking at this.
> > >
> > > I do wonder how feasible it is these days to totally hide the fact
> > > that a site is using JSF, given a couple of other giveaways like the
> > > standard jsf AJAX script and known scripts and CSS styles from several
> > > popular component libraries. Some patterns like the form name as
> > > hidden parameter and the client ID pattern of components (even when
> > > the default colon separator is changed to something else) are hints as
> > > well.
> > >
> > > Kind regards,
> > > Arjan Tijms
> > >
> > >
> > >
> > >
> > > On Mon, Jan 12, 2015 at 5:16 PM, manfred riem <manfred.riem_at_oracle.com (mailto:manfred.riem_at_oracle.com)> wrote:
> > > > Hi all,
> > > >
> > > > What is the general feeling about making the "javax.faces.ViewState" name
> > > > configurable?
> > > >
> > > > Thoughts?
> > > > Manfred
> > > >
> >
>