Question

To pass a hidden parameter from a JSF 2.0 Managed BEan action handler to a Servlet, I pass the parameter value into a Session attribute:

public void callServlet(long id) {
  try {
    ExternalContext ctx = FacesContext.getCurrentInstance().getExternalContext();
    HttpSession sess = (HttpSession) ctx.getSession(false);
    sess.setAttribute("id", id);
    ctx.redirect("MyServlet");
  } catch (IOException ex) {
    Logger.getLogger(ResultBean.class.getName()).log(Level.SEVERE, null, ex);
  }
}

Are there better ways to do this, for example is it possible to use the flash map to send this hidden parameter to the Servlet?

Answer 1

The Flash scope uses a combincation of cookies and session scope under the covers. So to achieve the same effect, you’d need to set a cookie by JSF and get the cookie in Servlet. But this is not much better than what you already have. Another way is to store the attribute by an unique identifier in the session and pass it as request parameter if you want to prevent the enduser from knowing/guessing the value and want to ensure integrity in multiple requests within the same session.

public void callServlet(Long id) throws IOException {
    ExternalContext ec = FacesContext.getCurrentInstance().getExternalContext();
    String uuid = UUID.randomUUID().toString();
    ec.getSessionMap().put(uuid, id);
    ec.redirect("MyServlet?id=" + uuid);
}

(note that I fixed your code to remove a potential NullPointerException and removed the need to have javax.servlet specific code in your JSF which is a sign of poor practice)

and in servlet:

String uuid = request.getParameter("id");
Long id = (Long) request.getSession().getAttribute(uuid);
request.getSession().removeAttribute(uuid);
// ...